Fix client_secret

The kid JOSE header was wrong.
Ended up patching jsonwebtoken to fix it. awlayton/node-jsonwebtoken@b82831b