Authentication fixes: grant_type and json response handling