added hybrid allowed for token endpoint