Guard against misconfigured homeservers when adding / binding phone numbers

This ensures we only fallback to submitting MSISDN tokens to the identity server
when we expect to do. Unexpected cases will now throw an error.

Fixes https://github.com/vector-im/riot-web/issues/10936

src/AddThreepid.js

@@ -236,6 +236,8 @@ export default class AddThreepid {
      */
     async haveMsisdnToken(msisdnToken) {
         const authClient = new IdentityAuthClient();
+        const supportsSeparateAddAndBind =
+            await MatrixClientPeg.get().doesServerSupportSeparateAddAndBind();
 
         let result;
         if (this.submitUrl) {
@@ -245,19 +247,21 @@ export default class AddThreepid {
                 this.clientSecret,
                 msisdnToken,
             );
-        } else {
+        } else if (this.bind || !supportsSeparateAddAndBind) {
             result = await MatrixClientPeg.get().submitMsisdnToken(
                 this.sessionId,
                 this.clientSecret,
                 msisdnToken,
                 await authClient.getAccessToken(),
             );
+        } else {
+            throw new Error("The add / bind with MSISDN flow is misconfigured");
         }
         if (result.errcode) {
             throw result;
         }
 
-        if (await MatrixClientPeg.get().doesServerSupportSeparateAddAndBind()) {
+        if (supportsSeparateAddAndBind) {
             if (this.bind) {
                 await MatrixClientPeg.get().bindThreePid({
                     sid: this.sessionId,