[BUG] Client secret not verified if not provided

[sywesk]

Hello,

While trying to get your lib working on my project, I saw that using Server.HandleTokenRequest with no secret leads to a valid token being generated. See the attached picture as a proof.

I used a sample configuration to get it to work:

	manager := manage.NewDefaultManager()
	manager.MustTokenStorage(store.NewMemoryTokenStore())

	clientStore := store.NewClientStore()
	clientStore.Set("000000", &models.Client{
		ID:     "000000",
		Secret: "999999",
		Domain: "http://localhost",
	})
	manager.MapClientStorage(clientStore)

	srv := server.NewDefaultServer(manager)

Notes: Giving a bad secret results in an error being thrown. But no secret works.

[sheepsong]

This is a fatal bug🤔
Should stay on v4.1.0 before the pr is merged.

[sywesk]

@sheepsong Good thing that issue appeared only recently ! My fear was that it went hidden for a long time but that's not the case.
Now that this is fixed, let's close this issue :D

[aubelsb2]

This is confusing me a bit I wrote up something here: #151 (comment)