auth: Deprecate unused client_secret parameter

OAuth2Mixin.authorize_redirect has never used this argument
and similar methods in this module don't have it.

Closes #1122

tornado/auth.py

@@ -63,6 +63,7 @@ import hmac
 import time
 import urllib.parse
 import uuid
+import warnings
 
 from tornado import httpclient
 from tornado import escape
@@ -571,7 +572,13 @@ class OAuth2Mixin(object):
 
            The ``callback`` argument and returned awaitable were removed;
            this is now an ordinary synchronous function.
+
+        .. deprecated:: 6.4
+           The ``client_secret`` argument (which has never had any effect)
+           is deprecated and will be removed in Tornado 7.0.
         """
+        if client_secret is not None:
+            warnings.warn("client_secret argument is deprecated", DeprecationWarning)
         handler = cast(RequestHandler, self)
         args = {"response_type": response_type}
         if redirect_uri is not None:

tornado/test/auth_test.py

@@ -550,7 +550,6 @@ class GoogleLoginHandler(RequestHandler, GoogleOAuth2Mixin):
             self.authorize_redirect(
                 redirect_uri=self._OAUTH_REDIRECT_URI,
                 client_id=self.settings["google_oauth"]["key"],
-                client_secret=self.settings["google_oauth"]["secret"],
                 scope=["profile", "email"],
                 response_type="code",
                 extra_params={"prompt": "select_account"},