fixes #190 - validates client credentials before grant type