allow clients with password grant to have no secret

[fixes #42683583]
Merge pull request #6 from daleolds/develop

* pull6:
  allow clients with password grant to have no secret