Consider auto_refresh_kwargs for token refresh authentication.

[fodinabor]

This is a follow-up on #340.

I agree that client_secret might be empty as of the spec: https://tools.ietf.org/html/rfc6749#section-6

      authenticate the client if client authentication is included and
      ensure that the refresh token was issued to the authenticated
      client, and

[coveralls]

Coverage increased (+0.04%) to 90.204% when pulling 52c19be on fodinabor:refresh-token-auth into d75279c on requests:master.