There's more...

When using the Implicit grant type, always be aware of requiring the redirect URI registration by the third-party application. This will ensure that the access token won't be delivered to an undesired registered client. Any malicious user might be capable of registering an application to try to impersonate another regular client application to receive an access token in its name, and the results might be disastrous if not requiring the registering of the redirection URI.