Auth code single use

RFC 6749 indicates that an authorization code must be used only once to issue an access token.
This PR simply adds this restriction.