Enforcing client authentication for the OnBehalfOf endpoint