oauth2orize.exchange.password with HTTP Basic scheme

oauth2orize.exchange.password requires username and password request params in url, but if i want to protect the `token` endpoint with basic http authentication (which is more secure than ClientPasswordStrategy), there is no way to exchange encrypted username:password key pair in headers for access token. Any suggestions?

Start at oauth2orize.exchange.password and the token endpoint, then compare the current URL username/password parameters with the requested HTTP Basic header flow. No files or tests are named; done would require a decided way to exchange Basic-authenticated credentials for an access token.

Written by the indexing model from the issue text.