Added origin parameter in options.hooks.validateClient

This is to provide the possibility of checking the originating domain
of the grantToken call, thus enabling clients to have a list of allowed
URLs.