client_secret is optional for a password grant_type