Registration - 2.2.1 client_secret should not be REQUIRED

[Nat Sakimura]

In the Response, currently it says:

{{{ client_secret REQUIRED. The Client secret. This MUST be unique for each client_id. }}}

Since the client may be a public client, client_secret should not be REQUIRED. It is only REQUIRED if the client type is confidential.

Note: If the client only uses implicit flow (such as self-issued), the client is a public client.

[Michael Jones]

We should add some rationale for why a client_secret is present even for public clients.

We should also state that this is a requirement for the server to send a client_secret - not a requirement that the client use it.

[Michael Jones]

We could eliminate the symmetric client secret for the registration endpoint by using an access token. The client_secret would then be optional, depending upon the client type.

[John Bradley]

The new logigic is:

Access token is optional for client_associate. Clients get a access token in client_associate and rotate_secret. They use that access token to perform rotate_secret and client_update

client_secret is now optional

I eliminated client_id from the request as it is now implicit in the access token.

[John Bradley]

Fixes #632 Added registration_access_token for updating and made client secret optional

→ 91b9e436d1c3

[John Bradley]

Re #632 add registration_access_token to example response

→ 4e5fe53670ce

[John Bradley]

RE #632 removed client_id from the request as it is now implicit in the access token for updates.

→ 2a43167d017b