fix bugs for AuthorizationCode flow