mod_http_oauth2: Add TODO about disabling password grant Per recommendation in draft-ietf-oauth-security-topics-23 it should at the very least be disabled by default. However since this is used by the Snikket web portal some care needs to be taken not to break this, unless it's already broken by other changes to this module.

---
labels:
- 'Stage-Alpha'
summary: Module deprecated, just use mod_smacks and mod_nooffline_noerror
...

Introduction
============

This module is deprecated and superseded by mod_smacks.
If you explicitly disabled mod_offline you need the new module
mod_nooffline_noerror to regain all features of this deprecated module.