[OAUTH-WG] Hashing passwords for "password" grant type

[Aaron Parecki <[e-mail]>]

Hi folks,

I'm implementing OAuth 2 for my project (geoloqi.com) where I have some
mobile phone clients needing to authenticate. I'm using the "password" grant
type for these clients. Even though the call to the token endpoint is going
over HTTPS, I'm still slightly concerned about sending the user's password
to the server unencrypted. (I don't want the users' passwords to appear in
my debug log file for instance.) Does the spec allow for or have a way to
extend so that I can define a hashing algorithm the client can use to
encrypt the password before sending it? I'm already not storing the
passwords in plain text in the database anyway. Anybody else dealing with a
similar issue?

Aaron