Omit client_secret from the authorization url

The client secret shouldn't be exposed in the authorization URL