Refuse AUTH_CODE and REFRESH for clients with no secret; some improved error responses