songkick/oauth2-provider — pull request #19 by bugant (2012-03-23 15:50:33+00:00)
Title: Let client_secret to be optional for assertion grants

OAuth2's draft#10 state that client credentials must be verified for an assertion grant only if present.
http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.3

It is now possible to obtain an access token for a specific client via an assertion grant request without revealing the client's secret.