Missing CSRF protection

### Issue Description

[OAuth 2.1](https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-12.html#name-preventing-csrf-attacks) requires that there is CSRF protection by using `state`, `nonce`, `code_challenge`, or a combination of those. It recommends to use at least `code_challenge`.