Auth codes can only be used once as described in the RFC 6749 Scetion 4.1.2
Fix #143