check code matches before returning access token