OAuth: reference PDS should reject PAR requests without DPoP proofs?

Hi all! I'm filing a few interesting bits of behavior I'm noticing in the reference PDS while implementing my own ATProto OAuth server. First up: https://atproto.com/specs/oauth#demonstrating-proof-of-possession-d-po-p says:

Clients must initiate DPoP in the initial authorization request (PAR).

...but the reference PDS currently seems to accept PAR requests without DPoP proofs. OpenVibe on Android is an example of a client that does this, which my server currently rejects, but logging into it with an account on a mushroom PDS works fine.

cc @ThisIsMissEm