Added option to pass client secret in either body, query string, or auth header