fix auth in code exchange