Fixed bug in password flow with missing secret

Credentials are blank only if both uid and secret are missing since in the resource owner password flow, a javascript app would only like to identify itself using the uid and not share its secret e.g. when official apps request tokens with password.