Allow public clients to use token endpoint, closes #611, closes #613
client API now generates client secret only for clients that require a client secret
more sanity checking for client secrets
got rid of extraneous "require client secret" box
resource registration returned the wrong URL
better auth method checking in dynamic registration and resource registration
removed extraneous data checks from resource registration
ported credential handling UI to dyn reg and res reg pages
updated display of saved client secret
don't regenerate client secrets every single time
fixed client secret display on dynreg and res reg pages
don't throw away creation time on protected resource update (oops)