Fixed token refresh for clientless access tokens

This is an issue that was brought to my attention by @ggayan. When I added the ability to obtain tokens without a client via resource owner password grants, I overlooked the ability to refresh the tokens created by that operation. This commit makes a couple of changes to refresh token requests:

1. If client credentials are included, they are validated.
2. If the authenticated client does not match the original client that obtained the refresh token, it will now use the `invalid_grant` error instead of the `invalid_client` error. The previous usage of `invalid_client` was invalid, according to [Section 5.2](http://tools.ietf.org/html/rfc6749#section-5.2) of the OAuth2 spec.