Add support for Resource Owner Password Credentials

This adds support for the [resource-owner password credentials](http://oauthlib.readthedocs.org/en/latest/oauth2/grants/password.html) flow.  E.g.:

    curl -X POST -d "username={yourname}&password={yourpass}&grant_type=password&client_id={your-app-id}&client_secret={your-app-secret}" https://yourserver.com/id/oauth/token


If it's a 403 we can probably do nothing, since that just means we failed authenticate, but anything else will be a valid exception in which case we should tell the user something other than that they had an incorrect u/p.