Fix for client_id in req parm and auth header

Fix problem of client_id being sent in basic authorization header and request parameter. See: http://forum.springsource.org/showthread.php?141347-client_id-passed-as-request-parameter-and-in-http-basic-authorization

I have signed the contributor agreement.