add implicit grants functionality

see #76 for design

@warner r?
It is feasible that this could cause a token to be created in the db even if removing the code failed. There is a check for the code and various parts of it, between L70-L87. Also, *at the moment*, since we only have 1 connection the DB, these promises can't actually complete concurrently, since the second will have to wait for the first to finish its query.

Adding a connection pool would make this more able to fail. In the success case, it'd be nice if both queries happened together, so we finish the request that much faster, but the safer course would be to just make them linear like you suggest.

Worth point out that in this state, if either of the fails, even if a token is generated in the database, it would never be returned as a response, since the error would trigger on the `spread`. Still, it would be inserting new tokens, so bad.