Authorization code fix

According to the RFC on Authorization code
http://tools.ietf.org/html/rfc6749#section-4.1.1

The client MUST NOT use the authorization code more than once.  If an authorization code is used more than once, the authorization server MUST deny the request

This fixes that to where a client can only use an authorization code once.

Excuse the incorrect branch name, btw...