You had me until "Please support HTTP basic auth for client authentication".
OAuth 2.1 draft spec emphasizes that basic auth is no longer preferred. I read that to mean: MAY, or perhaps even SHOULD NOT.
OAuth 2.1 draft spec emphasizes that basic auth is no longer preferred. I read that to mean: MAY, or perhaps even SHOULD NOT.
leeches
(To actually answer your question, there are a number of tricks you can use to prevent abuse that aren't effective when using http basic)