authenticate user via oauth2 resource password or implicit grant