Is there ways to protect uri "/oauth2/client" so that only users with some credentials can create clients?