Add an allowPublicClients option to disable check for Authentication header

This pull request replaces #20.

After further reading reading of the spec, my understanding is client type is a property of a client and not the entire server. With #20, the entire server would be configured public or confidential.  With this PR a server could be configured to handle both public and confidential client types and act appropriately. 

The *allowPublicClients* defaults to false to preserve compatibility with previous versions. 

If the option is false:
* any request without an authentication header will be rejected. 

If the option is true:
* requests without headers will be allowed, and clientId/clientSecret will be null
* requests with headers will be populated with the clientId and clientSecret

This approach also allows the potential for future support of the authorization_code grant type. Where you may receive a clientId but no secret: http://tools.ietf.org/html/rfc6749#section-3.2.1