Add fix to Request::AuthorizationCode to use client from uid

According to http://tools.ietf.org/html/rfc6749#section-4.1.3 the `client_secret` attribute is not required when using the authorization_code grant. Only the uid and the redirect_uri are validated on AccessToken creation.

I opened an issue regarding this code changes: #482