* validation of client moved into its own method and tested
* public clients have different validation - must have no redirect URIs
  and must have a clientName set