9bfd6f81 changed the format of authorization codes, but did not adapt the invalidation code accordingly. Because of this, authorization codes were not invalidated and could have been used multiple times to request access tokens until expiring.
