When refreshing tokens, require a client_secret _if_ the original token was also created with a client_secret

[evert]

Right now it's basically possible to refresh a token with just a clientId.

The OAuth2 spec requires that if the original refresh token was granted via a grant_type that requires basic authentication, then the refresh should also happen with the same method.

This is not a major security issue, but a security issue nonetheless.