Modified order of operations slightly

- Moved checkRestrictedGrantType() validation to before the user
  credentials validation; no reason to validate them if the client does
  not allow the password grant type.