validate app secret is different than client id