The following steps might help you in figure outing the solution for this:
Manage Apps > Connected Apps > Name of your App
Set "IP Relaxation" to "Relax IP restrictions".
Second, in my curl command which looked a lot like yours I left out the security token, so the password field was just the password.
I don't really know if I've solved my problem but I'm getting back an access token and not the "invalid_grant" error.
Looking for a comprehensive Salesforce Training? Enroll now!