FIX: client_credentials go to the oa2/token endpoint and not oa2/auth one