Update auth.md

redirect_uri is not required for implicit grant