Password can only be passed on initiation of flow, not as a later prompt

[PieterKas]

There is no option to present a password after the flow is initiated. Once the user has an MFA token, there is no way to prompt for a password. Some scenarios may need to prompt for a password after collecting say an OTP, or perhaps even and SMS code, depending on risk rules etc.

Options to consider:

• drop “password” parameter from authorization-initiation endpoint.
• add challenge_type=password in 3.4, add 7.2.6 and 7.3.6 for “persistent/traditional password challenge” and interaction.