Made client_secret optional for password grant

Since we can't trust all clients with the client secret I made the client_secret optional as per this blog post http://aaronparecki.com/articles/2012/07/29/1/oauth2-simplified.