tested working resource-owner-password strategy