Adds configurable response_type in the web auth flow.

This lets you use the implicit grant flow (response_type=token),
which means you don't need to store the app secret in the binary
anymore.