Allow hybrid clients on token endpoint