Unexpose OAuth grant type constants, and delete most

Unlike AFOAuth2Client, we're only doing implicit
auth for mobile as the default auth, and password
grant type as a minority option.
Add a convenient default for token_type on the credential
Add and integrate initial draft of implicit auth flow
Merge branch 'peng/add-implicit-auth' into peng/add-accounts-widget
Tweak account's active api