Check client_id matches authenticated client

When this parameter is supplied it should match the identity obtained
when authenticating the client.