authorization code grant does not require proof-of-possession of the code

b18c2e65-8f9e-41d5-9f83-29f3fe991f0f