OAuth consumer password grant flag

OAuth consumer keys can be configured to be allowed to use user credentials to gain an access token - how web2 authenticates against the API.

Moving to this means that sources such as web2 can now be identified as a comment source, like the mobile apps are (or the API).

**Note:** This also adds the `client_secret` requirement in order to authenticate successfully.