simple implementation of authorization code flow. with restrictions