There shouldn't be any differences in the `PasswordAccessTokenRequest` and the potential `AssertionAccessTokenRequest` to be honest, but I think by using the `PasswordAccessTokenRequest` for the assertion flow, the name didn't suite as much anymore. What do you think? I could also just remove the TODO comment