does this imply that each client (app) can only have one outstanding code at a time? I don't think that's true.. in fact a single user could have multiple codes outstanding for the same app (if they're logging in to the same RP on multiple devices at the same time).