allow setting of user/password to authorize (other than using 'code').

I just added an alternative way to authorize by directing giving user/password without getting into the redirect url login and get 'code'. The weibo php client has the feature, but this python client is missing it. So I'm adding it to serve for my purpose.
I assume the source only works if `session.auth` provided? add a `if` statement would be better.