Made client_secret optional for password grant