Removing need to client_secret during password grants for public clients

As discussed in issues #21 and #25. This provides a more rigerous check
of the circumstances required for the client_secret to forgone.
Merge branch 'no-client-secret'