#12 add the ability to support grant_type password without client_secret

This is based on http://aaronparecki.com/articles/2012/07/29/1/oauth2-simplified