- provide correct error instead of internal server error when no authorization code has been found (probably already consumed or expired)