HUMAN VERIFICATION REQUIRED ASVS 10.4.4 OAuth grants are restricted per client

For a given client, the authorization server only allows the usage of grants that this client needs to use. Note that the grants 'token'(Implicit flow) and 'password'(Resource Owner Password Credentials flow) must no longer be used.