Make signature validation exception for 'code' flow and the algorithm NONE