Fix: Hash passwords when 'client_secret' exists in POSTed data

Without this check, client_secret will be 'corrupted' in some cases, eg:
when updating redirect_uri (without specifying existing secret):

```php
$this->Client->save(array(
	'id' => 'foo',
	'redirect_uri' => 'http://mysite.com',
));
```