Investigate request_info for password argument

[tpazderka]

ok. It is wrong in any case, so the fix should do no harm, but probably the issue is burried somewhere in request_info().

Originally posted by @schlenk in #682

[schlenk]

From a cursory look, i would guess it gets passed in via oic.utils.authn.client.ClientSecretBasic.construct() when someone passes 'password' in the http_args. Maybe ClientSecretBasic should remove password from http_args in that case?

[tpazderka]

Yes, password is definitely used there, so maybe yes. Will have a look later today.

[tpazderka]

So a little bit more digging later... This turns out to be a case where the password should have been used as an authentication method, but is never passed to ClientSecretBasic and remains in http_args.

So a fix in client is in order.