Supporting implicit workflow during authorization

This adds implicit workflow support during authorization.
must be "code" or "token"