Add support for authorization code flow in auth module

[itsravenous]

zooniverse/planetary-response-network uses the authorization code flow instead of implicit because our app is a server app. Currently we're doing the code/access token gaining manually (well, via PassportJS). We then stuff the access token into the apiClient in the same way as the auth module does (apiClient.headers.Authorization = 'Bearer ACCESS_TOKEN_HERE'). This is OK, but it means we have to handle the refresh token stuff ourselves, instead of getting it for free with the auth module, which we would if we were using implicit flow.

Is there an appetite for a PR adding support for code flow? I know most of the Panoptes apps are front end so implicit works fine for them.