We should probably just include the tokens in the redirect URL, if we enforce https on it the likehood of loosing them is equally low than contacting the app directly from the server and it allows for a much easier client implementation, also mobile/desktop apps can intercept the redirect and read the token from there.