removed client_secret from refresh_token grant_type - it's optional for clients without client_secret (like refresh_tokens obtained by the password grant)
removed client_secret from refresh_token grant_type - it's optional for clients without client_secret (like refresh_tokens obtained by the password grant)

chrisdoehring/oauth2lib