If the token doesn't match (or isn't set) during the redirect. We should properly set it. Else we might redirect to a later auth display that set these values. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>