A proposal to make client_secret optional