Use rfc6749 to standardize authorization code feature

[jmcartlamy]

Currently, OAuth 2.0 Authorization Code flow is an experimental feature and doesn't use the good way to process the authorization code response.

Indeed, append a header Authorization with an encoding in base64 client_id+ client_secret doesn't work if the server which hosts the token endpoint follow the standards.

---

So, this commit follow the rfc6749 and standardize authorization code feature.

Moreover, client_secret is not required during the access token request. However, if the token endpoint ask it, the dev' just add it in the configuration and it will be automatically add in the parameters.

Edit: To resolve async issue on callback function (See issue #103), we return a Promise instead of undefined. Documentation has been improved in this way.

Edit 2: Sometimes, an user can keep code and state in the url parameters. JSO throw an error but in most of cases, tokens & authorization are ok. Now, we just log a line said it could not find retrieve state object.