Client authentication policies

Beside some minor fixes and cosmetics, the relevant code is the `client_authentication_required` method added in `oauth2_validators` module.