support grant_type 'password'