What should be done if the redirect URL already contains a code parameter?

[sebbASF]

The existing code uses a dict to hold query params, which means that adding a code param will replace any existing code param.

This is not documented.

Possible approaches are:

• don't allow a code parameter; throw an error if found
• allow an incoming code parameter, and return the Oauth code appended to the query string. It would be the responsibility of the caller to manage the extraction of the appropriate code entry.

See also #9 which aims to fix the loss of duplicate parameter names.