require the app secret when launching
client_credentials tests and refresh tokens created by client_credentials correctly contain the requested scopes
client_credentials tests and refresh tokens created by client_credentials correctly contain the requested scopes (2)
correct the applciation secret stuff
add the scope verifications for all requests containing a scope which should be matched against the client's scopes