drop client id and secret, fixes #56

it doesn't make much sense in most cases and only adds complexity to the default OAuth2 authenticator; if it's really needed it's easy to implement a custom authenticator and add it there