Implement client_secret_post authentication

Also simplifies the Basic authentication code by using having it return
Nothing for the failure case and using noteT to specify the 401 error,
making it obvious that the failure case is always the same.

Checking client secret is also changed to use Byteable for comparison
and is shared between both authentication types.
Tests for token endpoint authentication scenarios