Auth grant credentials

Added a configuration option to require client credentials for an auth grant request.  Defaults to false to maintain full backward compatibility.  If true, then a client_id and secret *must* be included in either the auth header or in the request body.