Fixed refresh tokens with confidential clients

This is an issue that was brought to my attention by @ggayan. When I added confidential client support to resource owner password grants, I overlooked the ability to refresh the tokens created by that grant. This commit makes a couple of changes:

1. If client credentials are included, they are validated. If no credentials are included, it is assumed that the client is confidential.
2. If the authenticated client does not match the original client that obtained the refresh token, it will now use the `invalid_grant` error instead of the `invalid_client` error. The previous usage of `invalid_client` was invalid, according to [Section 5.2](http://tools.ietf.org/html/rfc6749#section-5.2) of the OAuth2 spec.