Support client secrets, and require them if in confidential mode

[rmccue]

We have client secrets generated currently, but these aren't used or required anywhere. We need to require them (per spec) if the client is in confidential mode (as set in the admin).