def implicit_grant_with_creds(credentials, scope = nil)
    # this manufactured redirect_uri is a convention here, not part of OAuth2
    redir_uri = "https://uaa.cloudfoundry.com/redirect/#{@client_id}"
    response_type = "token"
    response_type = "#{response_type} id_token" if scope && (scope.include? "openid")
    uri = authorize_path_args(response_type, redir_uri, scope, state = random_state)

    # the accept header is only here so the uaa will issue error replies in json to aid debugging
    headers = {'content-type' => FORM_UTF8, 'accept' => JSON_UTF8 }
    body = Util.encode_form(credentials.merge(:source => 'credentials'))
    status, body, headers = request(@target, :post, uri, body, headers)
    raise BadResponse, "status #{status}" unless status == 302
    req_uri, reply_uri = URI.parse(redir_uri), URI.parse(headers['location'])
    fragment, reply_uri.fragment = reply_uri.fragment, nil
    raise BadResponse, "bad location header" unless req_uri == reply_uri
    parse_implicit_params(fragment, state)
  rescue URI::Error => e
    raise BadResponse, "bad location header in reply: #{e.message}"
  end
def implicit_grant_with_creds(credentials, scope = nil)
    # this manufactured redirect_uri is a convention here, not part of OAuth2
    redir_uri = "https://uaa.cloudfoundry.com/redirect/#{@client_id}"
    response_type = "token"
    response_type = "#{response_type} id_token" if scope && (scope.include? "openid")
    uri = authorize_path_args(response_type, redir_uri, scope, state = random_state)

    # the accept header is only here so the uaa will issue error replies in json to aid debugging
    headers = {'content-type' => FORM_UTF8, 'accept' => JSON_UTF8 }
    body = Util.encode_form(credentials.merge(:source => 'credentials'))
    status, body, headers = request(@target, :post, uri, body, headers)
    raise BadResponse, "status #{status}" unless status == 302
    req_uri, reply_uri = URI.parse(redir_uri), URI.parse(headers['location'])
    fragment, reply_uri.fragment = reply_uri.fragment, nil
    raise BadResponse, "bad location header" unless req_uri == reply_uri
    parse_implicit_params(fragment, state)
  rescue URI::Error => e
    raise BadResponse, "bad location header in reply: #{e.message}"
  end
Gets an access token in a single call to the UAA with the user
 credentials used for authentication.
 @param credentials should be an object such as a hash that can be converted
   to a json representation of the credential name/value pairs corresponding to
   the keys retrieved by {#prompts}.
 @return [TokenInfo]