title: Usage of response_type="code token" in OAuth 2?
body: <p>The OpenID Connect Spec <a href="http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations" rel="nofollow">OAuth 2.0 Multiple Response Type Encoding Practices</a> states that multiple response_type can be combined, e.g. <code>response_type="code token"</code>. Now I'm wondering what it's good for to request an authorization code <strong>and</strong> the token. Isn't the auth code superfluous if you have the token already?</p>