Remove client_credentials requirement for API calls (to avoid man-in-the-middle attacks)