mod_http_oauth2: Add TODO about disabling password grant Per recommendation in draft-ietf-oauth-security-topics-23 it should at the very least be disabled by default. However since this is used by the Snikket web portal some care needs to be taken not to break this, unless it's already broken by other changes to this module.

---
labels:
- 'Stage-Obsolete'
---

::: {.alert .alert-warning}
As of Prosody 0.12.x, `prosodyctl shell user list HOST` can be used
instead of this module.
:::

This module adds a command to `prosodyctl` for listing users.

``` sh
prosodyctl mod_listusers
```