Authorizers should be able to specify which credentials are required

[hyfen]

And raise an exception if not provided. Typically oauth authorizers need at minimum a client_id and client_secret.