Refresher on the authorization code grant flow