TokenManager validates authCode w/ tests