The server must reject access tokens containing a 'cnf' claim, as it indicates that the token is sender-constrained and must be validated along with a proof-of-possession of a corresponding client private key. Since the server does not yet support proof-of-possession validation, it must disallow the usage of this claim in all access tokens.