Implicit grant not checking the Redirect URL

[PumpkinSeed]

In OAuth2 for the implicit grant you have to check the Redirect URL, because in this case this is the only way to authorize the client identify. I checked and your application not check it, and I can use any redirect URL if I know the client key.
If you agree it, I can create a pull request for fill the security hole.

[RichardKnop]

@PumpkinSeed Thanks. That would be great if you can create a PR to fix this 👍