oidcserver: fix login events not being raised for webadmin

we should remove implicit flow at some point . also #844

dashboard/authcallback.html

@@ -2,6 +2,7 @@
 
 var tmp = window.location.hash.slice(1).split('&');
 
+// FIXME: implicit flow (response_type=code token) results in access_token query param. this is not secure
 tmp.forEach(function (pair) {
     if (pair.indexOf('access_token=') === 0) localStorage.token = pair.split('=')[1];
 });