Better error messages

401 for username/password failure
404 for client authentication failures
400 for all other errors
Fix in Client Authentication - client_id and client_secret are required parameters
Fixes scope validation in public password grant

Validate scope by default for all ScopeMixin children.
One more better error message - 403 on invalid scope.