fix implicit grant forces authentication, add refresh_token grant type