Fix broken api module: use the string versions of the client secret

This is ugly, but because `Consumer#secret` is a UUID, we should be using
the `Consumer#client_secret` property here which is a string (unicode)
representation of the secret.

The prior state causes 500s on the token endpoint on a fresh checkout.
The getattr isn't necessary. It's guaranteed at this point that the attribute exists.
https://github.com/tilgovi/pyramid-oauthlib/blob/master/pyramid_oauthlib/__init__.py#L70