Based on the following document, the new OAuth-based authentication doesn't require user to provide a username and password, does that mean any user get the consumer key and secret will able to access the REST API, and don't need user authorization at all?
http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-oauth.html
this is the previous oauth flow:
http://devdocs.magento.com/guides/m1x/api/rest/authentication/oauth_authentication.html#OAuthAuthent...
