PKCE for confidential clients