OAuth 2.0 (RFC 6749) violations

Sections [10.3]( and [10.4]( of RFC 6749 requires the authorization server to use TLS when exchanging the access and refresh tokens; however Vaultwarden—which acts as both the resource and authorization servers—currently does not force TLS, meaning deployments without TLS violate the RFC. Additionally [Section 6]( requires the refresh token to be uniquely linked to the client; however Vaultwarden does not have a UNIQUE CONSTRAINT defined on devices.refresh_token which means it's possible, albeit unlikely, for multiple clients to have the same refresh token. If adherence to RFC 6749 is not a goal, I do believe a UNIQUE CONSTRAINT should still be defined on devices.refresh_token since it will ensure the token is truly unique. Furthermore [Vaultwarden already (incorrectly) assumes/hopes the refresh token is unique]( and with an actual UNIQUE CONSTRAINT defined—which will be backed by a UNIQUE INDEX with any real-world RDBMS I am aware of—the performance will be even better (an…