Client secret, server tokens for developer applications returned by internal API

Summary

@appsecure_in identified an internal API for https://riders.uber.com that could return client_secret and server token for applications authorized by the account owner to access their Uber account. We restricted the data returned by this endpoint.

Thanks for bringing this to our attention, @appsecure_in!