Do you really need to re-query the client collection when using the password exchange?

Is querying your client collection and validating secrets necessary as in the password grant example [here](https://github.com/jaredhanson/oauth2orize/blob/master/examples/all-grants/oauth2.js#L102-L103)?

It was my understanding that passport would validate the secret, and `deserializeClient` method would make the `client` parameter accurate to the clients collection. Do really I need to reverify here as the docs suggest?

Start with examples/all-grants/oauth2.js around lines 102-103 and trace how deserializeClient supplies the client during the password exchange. Verify whether Passport already validates the secret and determine what the example should explain. Done means the documentation or example has a definitive answer about whether the additional query and validation are required.

Written by the indexing model from the issue text.