Deprecate and do not pass client_secret in .authorize_url

Fixes #331
Merge master