fixed default oauth2 authorization endpoint for password credential flow