merged master
save grant upon authorization, redirect user to redirect_uri
do not check if grant token already exist
fixes and enhances