Update strategy.js

According to specs http://tools.ietf.org/html/rfc6749#section-2.3.1 clientSecret MAY be an empty string