client_secret should be optional.
Don't assume optional fields are required and use Basic Auth if available.

See https://github.com/golang/oauth2/issues/33
Fix error message prefix.