add generate-client.js script

deprecates keeping client.secret in config files (you'll get a WARN)

see #98. Not sure if this completely fixes it or not. But I got tired of generating credentials manually.

@warner r?
Probably not worth a db ALTER TABLE, but it'd be less confusing if this column were named `hashedSecret` instead of `secret`.