Prevent spamming emails by reusing client secret

Generate a client secret in the Signup class (if we don't already
have one) and re-usae it for subsequent attempts to register,
that way the IS can honour the sendAttempt flag and not re-send
the email if we're just retrying and requestToken becomes
idempotent.

src/SignupStages.js

@@ -158,7 +158,11 @@ class EmailIdentityStage extends Stage {
             return this._completeVerify();
         }
 
-        this.clientSecret = this.client.generateClientSecret();
+        this.clientSecret = this.signupInstance.params.clientSecret;
+        if (!this.clientSecret) {
+            return q.reject(new Error("No client secret specified by Signup class!"));
+        }
+
         var nextLink = this.signupInstance.params.registrationUrl +
                        '?client_secret=' +
                        encodeURIComponent(this.clientSecret) +