Add app 'type' field to app create form

This will allow for differing handling of permissions based
on application type.

* Web app: Web-hosted application. Can keep a client_secret

* Installed app: e.g., android app. Client secret is not so secret
See also: https://developers.google.com/accounts/docs/OAuth2InstalledApp

* Script: For simple scripts and bots. Client secret is assumed secret.
Allow "script" apps grant_type=password

Only application devs will be permitted to use password grants,
to discourage widespread use. Password grants are intended
to be a convenience for bots & personal scripts, to encourage
use of OAuth tokens and ease transition to OAuth2.

For more info on password grants, see:
http://tools.ietf.org/html/rfc6749#section-4.3