add generate-client.js script

deprecates keeping client.secret in config files (you'll get a WARN)

see #98. Not sure if this completely fixes it or not. But I got tired of generating credentials manually.

@warner r?