password grant_type requires secret?

[tj]

it should be optional so you can have things like command-line tools that are user-accessible but wont expose a secret

[hillct]

I was just now looking at the oauth2-provider implementation of the password flow and it seems like the client is meant to be authenticated, prior or during the password auth flow as described here:

http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.3

Checking notes actually explain the calling convention which seems consistent with the oauth2 draft. 074f9a8
It would be useful to add the calling URL example to the docs though.