fix mistake where token was being used when auth code should have been