validate signature and nonce at /api/oauth/access_token endpoint