but if you just need it for log in, I assume you would use the replacement for implicit grant, since that is dead