added request for access token in app's onAuthorizationCodeHandler, including sha256 signing