add client secret verification for tokens