can resource owner from passwoed credentials