Test authorization code flow with rejected access