Ensure client secret is erased from OAuth2Authentication

Fixes gh-321