remove check for ":" when setting client_id and client_secret, it will work fine with credentials in request body