Omit client_secret from the authorization url. Fixes #39