Do not follow redirects when sending the client secret to the token URL

Stops the token request from following 307 and 308 redirects, so the client secret is never re-sent to a new address.