Submit the authorisation (login) form

Authenticates the resource owner's username and password against the same fields listed above plus username, password and csrf_token, then redirects to redirect_uri with an authorisation code (or an error) per RFC 6749 section 4.1.2. No bearer authentication is required.