Adds configurable response_type in the web auth flow.

[keichan34]

This lets you use the implicit grant flow (response_type=token), which means you don't need to store the app secret in the binary anymore.