Existing params can be dropped when code param is added

The existing code uses a dict to hold query params, which means that adding a code param will replace any existing `code` param.

This is not documented.

Possible approaches are:
* don't allow a `code` parameter; throw an error if found
* allow an incoming `code` parameter, and return the Oauth code appended to the query string. It would be the responsibility of the caller to manage the extraction of the appropriate code entry.

See also #9 which aims to fix the loss of duplicate parameter names.

Locate the code that builds the query-parameter dict and reproduce the case where an incoming `code` parameter is present before the OAuth code is added. Review issue #9 and decide which documented behavior this issue should follow; done means existing parameters are no longer silently lost and the chosen behavior is covered by a test.

Written by the indexing model from the issue text.