Change default generator for client_id and client_secret: now use a safe set of characters that don't need escaping. That way we should avoid problems with many dummy client implementations
Add support for authenticating confidential client with request body params. Fix #55