enforce redirect_uri validation only if client specified redirect uri for application