Removing need to client_secret during password grants for public clients

As discussed in issues #21 and #25. This provides a more rigerous check
of the circumstances required for the client_secret to forgone.

(includes tests)