Public clients can do Authorization Code grants