Auth codes can only be used once, so clear the code just before
performing token exchange to ensure that it is not reused later.