AllowedCodeChallengeMethods is forced to include plain.

[james-lawrence]

due to this line its required that allowedcode challenge methods includes plain in order for the code to operate. this default should be removed or be provided by the configuration.