Use either token secret or consumer secret, not both.

Note that if an authentication helper is provided as 'auth', this object is now always preferred.

This closes https://github.com/Birdback/b/issues/447.