allow clients with password grant to have no secret

[fixes #42683583]