Fix bug in client_authentication_required call

I forgot to pass `request` parameter to `client_authentication_required` in `authorization_code` module, fixed with c38dab5.

Added tests involving `client_authentication_required`, I tried to be coherent with existing code per testing module.

While writing tests, I stumbled upon a strange behaviour in request's `duplicate_params` property, if I understood correct there's a bug involving operators precedence.