OAuth2 Implicit flow should allow a list of ports

[Colin-b]

In case some might be already taken and application supports multiple redirection on localhost