Exchanges presented for a browser session. No approval round trip: a valid, unexpired, not-yet-used code creates the session immediately.