secret is required, clients must use require(‘oauthserver-mongoose’).secretGenerator()