Fix #257

This pull request addresses #257 by allowing a client to use the "password" grant type without needing to pass a client assertion. It operates as follows:

- If a "password" grant type is detected in the TokenController, it checks to see if we have a ClientInterface storage composed, and whether or not a `client_id` was passed in the `POST` variables.
- If the above conditions are met, it will then check if the client allows the password grant type.
- If the above conditions are met, it will then check if the user credentials are valid.
- If the above conditions are met, it will then validate the requested scope.
- If all of the above are met, it will return an access token.

If the first set of conditions fails, it will fall back to normal client assertion. If any of the middle three conditions fails, it will return a 400 response indicating the type of failure (invalid grant type, invalid credentials, invalid scope).

To make this happen, the TokenController now allows an additional, optional final argument, an `OAuth2\Storage\ClientInterface` instance. The `Server` class, if creating a default TokenController instance, will detect if either a `client` or `client_credentials` storage instance is present, and, if so, pass it on to the TokenController constructor.

In addition to the test I've provided, I have done an ad-hoc integration test via `zfcampus/zf-oauth2`, and verified that I was able to validate user credentials to obtain an access token.