Add status code check
Include client secret in token exchange