use :password_credentials instead of :password to keep consistency.
Revert "use :password_credentials instead of :password to keep consistency."

This reverts commit 88d50d3efa88e3343a6825e7b388d3701f313636.
use a simpler term "password"
Use strings instead of symbols to avoid Symbol DoS issue
add tests for enabling grant_type=refresh_token
use expect syntax in RSpec, to keep consistency with other tests.