[cfid-638] Treat password grant as a special case for approvals

Add a grant_type field to both refresh and access tokens, and use it to auto-approve ALL
requested scopes in case of a password grant.