Removing need to client_secret during password grants for public clients

As discussed in issues #21 and #25. This provides a more rigerous check
of the circumstances required for the client_secret to forgone.
Not sending a refresh_token to public clients requesting password_grants
Public and private clients can now have different expiry times

Public clients often wish to have shorter expieration times
Clean up and PEP8 for #41.
Bumping version to 0.2.7-dev to avoid ambiguity in an established package.