Sure, the redirected-to url will be different each time, as it includes the `code` and `state`. My understanding was this: 

1. when registering, a client MUST include it's intended redirect_uri. It can include paths and query parameters.
2. when requesting a code, a client MAY a redirect_uri, which must match the registered one. ie `query.redirect_uri === registered.redirect_uri`. If not included, no problem, just use the registered uri.
3. Redirect to `url(redirect_uri).addQueryParam('code', code).addQueryParam('state', state).toString()`

I do the verification [here](https://github.com/mozilla/fxa-oauth-server/blob/oauth2/lib/routes/authorization.js#L51-L58) and the redirection [here](https://github.com/mozilla/fxa-oauth-server/blob/oauth2/lib/routes/authorization.js#L69-L77)