Important *not* to include client credentials but then we do

[bertramn]

Could you please clarify what below comment means? It states "its important not to include it" but then it is included. Also can you please expand on how exactly a caller might gain access tokens from that endpoint without supplying consumer key and secret? I am a bit scared to install this after reading the comments! Many thanks.

api-platform-samples/default-proxies/oauth/apiproxy/policies/GenerateAccessTokenClient.xml

Lines 7 to 10 in a0ececb

	<!-- This part is very important: most real OAuth 2.0 apps will want to use other
	grant types. In this case it is important to NOT include the "client_credentials"
	type because it allows a client to get access to a token with no user authentication -->
	<GrantType>client_credentials</GrantType>