Fix token extraction for implicit grant type

Token parameters are added to the fragment component of the redirection URI, not the query (http://tools.ietf.org/html/rfc6749#section-4.2.2).