Smarter passing of OAuth app creds in query params

Prior to this change, we were _always_ passing OAuth app `client_id` and `client_secret` in the query params if present.

To prepare the way for some new app-authenticated methods, this change makes sure those are only passed in the query params for anonymous requests.