Hm. That *is* a downside of storing hashed codes, because there's no "key-id" to narrow it down to a single possibility (like we do with HAWK). But we can narrow it down to the `client_id` first, right? (assuming we have an index on that column). There shouldn't be too many outstanding at once for a single app.

Also, these need to expire after a short while (maybe 15min).