Remove unused credentials from access token request

The "credentiels" parameter isn't used by the resource owner password grant on the server, so this code has been dead for well over a year (I suspect).