WebAuth: Be explicit that we only support the "auth code" flow and not the "token" flow.