Smarter passing of OAuth app creds in query params

Prior to this change, we were _always_ passing OAuth app client_id and
client_secret in the query params if present.

To prepare the way for some new app-authenticated methods, this change
makes sure those are only passed in the query params for anonymous
requests.
Merge pull request #465 from octokit/app-creds-in-query

Smarter passing of OAuth app creds in query params