implement immediate query flag

I know this is not in the spec, but this is the easiest way to implement support for it. Also it could be useful for others.

The only other solution i saw was to split the validation and immediate code handling into two different middlewares.

It is based on SalesForce's documentation [1].

The use case is that I want to do the authorization in a hidden iframe and only fallback to redirect if it fails.

For reference, I'm using it like the following code.

I don't think the `x-frame-options` part should be part of `oauth2orize`.

```js
module.exports =
  [ function (req, res, next) {
      if (req.query.immediate === 'true') {
        res.removeHeader('x-frame-options')
      }
      next()
    }
  , server.authorize(validate, immediate)
  , ensureLoggedIn()
  , renderDialog
  , server.errorHandler({ mode: 'indirect' })
  ]
```

[1] https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_web_server_flow.htm&language=en_US