Allow public clients to use token endpoint, closes #611, closes #613
client API now generates client secret only for clients that require a client secret
more sanity checking for client secrets
got rid of extraneous "require client secret" box
resource registration returned the wrong URL
better auth method checking in dynamic registration and resource registration
removed extraneous data checks from resource registration
ported credential handling UI to dyn reg and res reg pages
updated display of saved client secret
don't regenerate client secrets every single time
fixed client secret display on dynreg and res reg pages
don't throw away creation time on protected resource update (oops)
Merge remote-tracking branch 'remotes/origin/master' into smart-launch
Revert "Allow public clients to use the code flow"

This reverts commit f106531a8c38692847ae8ff5baf10668bfd86de6.