Add some validation logics for POST /oauth/token