Remove unused nonce from login flow

[BruceMacD]

The nonce is used to mitigate replay on attacks on implicit OAuth login flows, we don't need it on our authorization code flow.

Around the time our login flow was implemented there was a typo in the Okta docs for the authorization code flow that said it was required:
https://devforum.okta.com/t/authorization-code-flow-is-the-nonce-parameter-necessary/12150

• Wrote appropriate unit tests
• Considered security implications of the change
• Updated associated docs where necessary
• Updated associated configuration where necessary
• Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
• Nothing sensitive logged