Add url check

If we don’t check the url then tokens issued for other websites could
be used.