add a new test case for SwtVerifyHandler to pass the client_id and client-secret from request headers

[stevehu]

The authorization header is parsed and output to check if the default client_id and client_secret are passed in or not.