Add tests for implicit flow

This didn't actually require any new code.
should this be public_redirect_uri?