break out redirect from auth code response
fixing token checking