fix: truly replace .flat() to support Node <11 again (#1691)

* Fix validation of provider existence before looking for protection property

* Use optional chaining

src/server/index.js

@@ -79,7 +79,7 @@ async function NextAuthHandler (req, res, userOptions) {
       provider.protection = 'state' // Default to state, as we did in 3.1 REVIEW: should we use "pkce" or "none" as default?
     }
 
-    if (typeof provider.protection === 'string') {
+    if (typeof provider?.protection === 'string') {
       provider.protection = [provider.protection]
     }
 

src/server/lib/oauth/state-handler.js

@@ -41,7 +41,7 @@ export async function handleCallback (req, res) {
 export async function handleSignin (req, res) {
   const { provider, baseUrl, basePath, csrfToken } = req.options
   try {
-    if (![provider.protection].flat().includes('state')) { // Provider does not support state, nothing to do.
+    if (!provider.protection.includes('state')) { // Provider does not support state, nothing to do.
       return
     }