token redirect with 303 instead of 302