Require basic auth for token
Add test for OAuth client creds

In the POST body