add implicit grants functionality

see #76 for design

@warner r?
Ah, `spread()` is one of those fail-if-any-single-input-fails methods. Cool.

I suppose that really, we'd want the `removeCode` and the `generateToken` to occur in the same DB transaction, so that if the server got bounced in between these two calls, the caller wouldn't get stuck with a lame code but no token. OT3H, the caller isn't part of the DB transaction, so it's totally possible to get into that state anyways, like if the network eats the response after the server has finished committing everything. The byzantine generals can't win.