grant.token redirect uses 303 instead of 302 not to break https