Fix broken api module: use the string versions of the client secret

This is ugly, but because `Consumer#secret` is a UUID, we should be using
the `Consumer#client_secret` property here which is a string (unicode)
representation of the secret.

The prior state causes 500s on the token endpoint on a fresh checkout.
It's there just to make this easier to test.


> On 13 Nov 2014, at 19:40, Randall Leeds <notifications@github.com> wrote:
> 
> In h/api.py:
> 
> > @@ -256,9 +256,9 @@ class Token(BearerToken):
> >      def create_token(self, request, refresh_token=False):
> >          client = request.client
> >          message = dict(consumerKey=client.client_id, ttl=client.ttl)
> > -        message.update(request.extra_credentials or {})
> > +        message.update(getattr(request, 'extra_credentials', {}))
> The getattr isn't necessary. It's guaranteed at this point that the attribute exists.
> https://github.com/tilgovi/pyramid-oauthlib/blob/master/pyramid_oauthlib/__init__.py#L70
> 
> —
> Reply to this email directly or view it on GitHub.
>