OAuth2 Implicit Grant and SPA