client_secret shouldn't be required for grant_type `password`.

While using grant_type `password`, transmitting a `client_secret` is not required or/and shouldn't be used under the assumption that most of the use cases for password grants will be mobile or desktop apps, where the secret cannot be protected.