add note

src/js/client.js

@@ -1139,6 +1139,7 @@ angular.module('Application').service('Client', ['$http', '$interval', 'md5', 'N
         window.location.href = this.apiOrigin + '/api/v1/session/logout?redirect=' + origin;
     };
 
+    // this is ununsed because webadmin uses implicit grant flow
     Client.prototype.exchangeCodeForToken = function (code, callback) {
         var data = {
             grant_type: 'authorization_code',