OK, I know why I used `:password` instead of `:password_credentials`

Because in the OAuth 2 spec, when requesting token, the parameter will be `grant_type=password`. Therefore I think we should keep `:password` but add comments on why they're inconsistent.