add implicit grants functionality

see #76 for design

@warner r?
Oh, right, this is used by the user (not the relier), who supplies and assertion and asks the server to make a token for a given (approved) client_id. So no client_secret necessary.