Allow public clients to use the code flow

fixes mitreid-connect/OpenID-Connect-Java-Spring-Server#611

I don't know how Spring-y this approach is. But as far as I can tell, the Spring OAuth team wasn't thinking much about public clients using the code flow when they designed the library. In particular, there are strong assumptions that the various Users along the way will have secrets. Things crash when those secrets are null.

This PR works with the current "self-sevice" registration function, which *does* assign secrets even to public ("No Authentication" at token endpoint) clients. It's just that the secrets are never used (but they have the benefit of preventing Spring from crashing.)