PKCE downgrade on public OAuth clients

If the token endpoint still accepts a plain or absent code_verifier, an intercepted code is redeemable without the secret.