[Issue #94] When the pair client_id/client_secret is not provided in request body, check Authorization header

[rossitsaborissova]

The issue was originally raised by nilswieber: "Sometimes OAuthClients do a TokenRequest with the client_id in the body (without the client_secret) and provide client_id and client_secret in the authorization header.

So the clientId would be !=null but the clientSecret == null. In that case the authorization header won't be evaluated."