More tests for authorization code flow