Difference between using authorization code or not?