splits client credentials validation into two tests (this is best practices)