add generate-client.js script

deprecates keeping client.secret in config files (you'll get a WARN)

see #98
Merge pull request #112 from mozilla/generate-client

add generate-client.js script