make redirectUri mandatory for authorization code and user nullable