Consider challenges taken from the session

[paulbastian]

Instead of challenges received from the challenge endpoint, protocols utilizing this draft could also leverage existing artefacts/ids/tokens from the session, e.g. using the authorization code or access token.