You used https://v2.steemconnect.com/oauth2/authorize?client_id=appname&response_type=code&redirect_uri=https%3A%2F%2Fappname.herokuapp.com%2F&scope=vote? It returned a code in the query string, and that's what you're using for code, right?
The POST to /api/oauth2/tokenJSON response was valid? Do you have that? I just want to verify the structure.
RE: Tutorial: OAuth2 Access Tokens and Refresh Tokens with Steemconnect