title: OpenIdDict - WebApi endpoint protection
body: <p>I am trying to implement WebApi protected by access_token issued by an OpenIdDict auth server.
  Some APIs don't require authentication, while others do.
  The former (the public ones) it is sufficient to provide a client_token, while for the latter an access_token.
  The .NET core Client that will use these APIs will then have to insert the client_token or the access_token in the header.</p>
  <p>How do I implement a ROPC that initially requires a client_token (possibly putting it in a cookie) which will then replace with an access_token at the moment when it authenticates?</p>
  <p>Thank you</p>