[OAUTH-WG] Issue 15, new client registration

[Torsten Lodderstedt <[e-mail]>]

2.1 Client types

I'm struggeling with the new terminology of "private" and "public" 
clients. In my perception, the text just distinguishes clients which can 
be authenticated and such which cannot. This is fine but I consider the 
wording misleading. I would suggest to change it to something like 
trusted/untrusted or authenticated/unauthenticated or Verifiable/Forgeable.

Moreover, I think merging section 2.1 with the text on client types in 
section 10 would make sense for the following reasons:
- there is large overlap between them
- It would introduce the term "native application" before it is used for 
the first time in Section 9

2.2. Registration Requirements

Why is the redirect URI a MUST? It should be a MUST for clients using 
the implicit grant and probably for "private" clients but why generally? 
I would suggest to change this to RECOMMENDED.

2.4 Client Authentication

"In addition, the client and authorization server establish a client
    authentication method suitable for the client type and security
    requirements of the authorization server."

Does this hold true for public clients?

2.4.1 Client Password

""