Verify client secret. This is a secure bug.

https://github.com/lepture/flask-oauthlib/issues/92