Delete authorization code after use per RFC section 4.1.2

Add interface for deleting an authorization code after it's one time use. Technically I could keep the code and mark it as invalid in order to revoke any access tokens issued for that code but since the code is not stored with it's issued access tokens, deleting the code after use is the next best thing.

4.1.2.  Authorization Response

   If the resource owner grants the access request, the authorization
   server issues an authorization code and delivers it to the client by
   adding the following parameters to the query component of the
   redirection URI using the "application/x-www-form-urlencoded" format,
   per Appendix B:

   code
         REQUIRED.  The authorization code generated by the
         authorization server.  The authorization code MUST expire
         shortly after it is issued to mitigate the risk of leaks.  A
         maximum authorization code lifetime of 10 minutes is
         RECOMMENDED.  **The client MUST NOT use the authorization code
         more than once.**  If an authorization code is used more than
         once, the authorization server MUST deny the request and SHOULD
         revoke (when possible) all tokens previously issued based on
         that authorization code.  The authorization code is bound to
         the client identifier and redirection URI.