A client_id can come in many forms. Your implementation is one of those forms.
Others come in the form of an OAuth2 POST where client_id/client_secret is in the form of an application/x-www-form-urlencoded value or in the header as basic auth.

In others the could show up somewhere in an application/json post.

The client filter is nice but I need to change where that client_id is coming from.