Why does Resource Owner Cred. Grant not required client secret?

[jeffijoe]

I noticed both clients are set as Confidential, which according to the OAuth spec would require the server to authenticate the client making the request.

This is only the case for the resource owner credential grant, the refresh token grant does accept a client secret. Why is this?

Thanks for this sample, it has helped me tremendously!