add implicit grants functionality

see #76 for design

@warner r?
are we pretty confident that nobody else is going to `require('./routing')` and get confused by us mutating it here?