Adds a spec to verify extra header params on Client Credentials

Hi folks! This is the extracted spec file mentioned waaaay back in #257.

Hopefully it's all OK, but let me know if I should make changes.