Removed requirement on client_secret since sometimes it's entirely possible a
system is configured with a client_id but no secret