Implicit errors are not always redirected in the fragment

[night]

All OAuth2 errors don't seem to be returned properly for implicit grants, as some are sent within the querystring as opposed to the fragment per the RFC.

It looks like the overarching error handling logic isn't customizable per grant, and the authorization server itself has a blanket catch for error handling: https://github.com/lepture/authlib/blob/master/authlib/oauth2/rfc6749/authorization_server.py#L171

If the resource owner denies the access request or if the request
fails for reasons other than a missing or invalid redirection URI,
the authorization server informs the client by adding the following
parameters to the fragment component of the redirection URI using the
"application/x-www-form-urlencoded" format, per Appendix B:

See https://tools.ietf.org/html/rfc6749#section-4.2.2.1 for more details.

[lepture]

Thanks, I've fixed it.