Added tests for client_secret in tokens