Add additional oauth2:authorize_password/6 with previous client authentication and fix for #38

WARNING: Breaks the compatibility with existing backend implementations

The client can now be authenticated before the resource owner's
credentials. See RFC6749 / Section 4.3.2 for more details.
In addition to AppCtx and Scope, oauth2_backend:verify_resowner_scope/3
now returns the ClientIdentity so that oauth2:authorize_resource_owner/3
can set the client for the #authorization{} record and
oauth2:refresh_access_token/5 can be successfully executed.