buildTokenRequest repeated the form-encoded POST construction and the shared headers across the basic-form, none and post-form branches. Extract newFormTokenRequest, and fold the public-client none case into the default branch — it differs only in omitting client_secret. Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>