Add the ability to support grant_type password without client_secret

This is based on http://aaronparecki.com/articles/2012/07/29/1/oauth2-simplified and discussed in #12.

@pelle, let me know what you think of this. I'm happy to tweak the interface if there's anything about it that doesn't feel right to you.