support empty client_secret in the Authorization header

Fix throwing InvalidRequest Exception when client_secret is an empty string.