Added ClientFlow and AssertionGrant for clients, with @leastprivilege