title: IdentityServer3 - When is username/password enough for token
body: <p>I am trying to implement authentication/authorization using IdentityServer3 for my ASP.NET Web API v2. The client is a simple HTML and jQuery application. The client uses AJAX to make some API calls to my back-end API.</p>
  
  <p>I remain confused on the need for a <code>client secret</code>. Shouldn't the username/password combination be enough for IdentityServer3 to hand back a JWT token? </p>