I think `password` grant type will always need to be verified with `Authorization` header.