https://www.pivotaltracker.com/story/show/68894754
Correctly place authentication details as part of the authentication made during client secret change.