getToken now takes clientID and clientSecret params. Decision middleware still borked.