fix code -> token exchange