removed requirement on client_secret since some it's entirely possible a system is configured with client_id but no secret.