add authentication to the fetch tokens from code

[yoavya]

Issue #7

• allow cognito app with secret in case that the cognito app has a secret
• app secret can now be received in params as userPoolAppSecret

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[yoavya]

fixed documentation

[jeandek]

Just tested your changes and they work perfectly. Thanks @yoavya and my apologies for the delay in merging this.