add implicit grants functionality

see #76 for design

@warner r?
does this also assert that the request includes the correct `client_secret`?