Require a client when exchanging an authorization code

If you use public clients, consider using timshadel/passport-oauth2-public-client
as your authentication strategy to ensure that you have a client object
prior to the exchange taking place.