Check client's allowed grant types for authorize requests #111

Potential solution for #111

Add checks for restricted grant type to Authorize Controller.
Means that clients need 'implicit' grant type to use implicit flow, and
clients that can't use auth code flow get bumped on the authorization step
not the token step.

Not totally sure I've got the checks in the right place. And I'm suspect "implicit" should really be a constant defined somewhere, rather than hardcoded.

Let me know if I should be doing any of this differently