actually check that the user authorized the browser flow