add implicit grants functionality

see #76 for design

@warner r?
If `db.removeCode()` fails (because the code wasn't a real one), would this generate a token anyways? That'd be bad. I imagine that there's some earlier test that makes sure `code.code` is real, but it'd be nice to do that test here for safety (maybe by making the promise chain be `db.removeCode` -> `db.generateToken` -> `toToken` -> `reply`). OTOH, it's a hassle to set up a promise chain that passes `code` into both `removeCode` and `generateToken`.

What if `generateToken` looked like:

```
function generateToken(code) {
    return db.removeCode(code.code)
        .then(function(_) {return db.generateToken(code);});
}
```

and then we could get rid of the `.spread()` later?

If you go that way, you might also name this "removeCodeAndGenerateToken", to avoid confusion between this local `generateToken` and the `db.generateToken` which it calls.