This is the line that drove me crazy and made me open and close several PRs. Accordingly to http://tools.ietf.org/html/rfc6749#section-5.2 a failed client authentication should return a invalid_client error. However, the error codes returned by this request are actually listed in http://tools.ietf.org/html/rfc6749#section-4.1.2.1 and doesn't contain invalid_client. So I'm changing it to unauthorized_client.