Allow empty string for clientSecret

According to specs http://tools.ietf.org/html/rfc6749#section-2.3.1 client_secret MAY be an empty string