diff --git a/dub.json b/dub.json
index ea1aec0..4d1ab94 100644
--- a/dub.json
+++ b/dub.json
@@ -9,7 +9,7 @@
   ],
   "targetType" : "library",
   "dependencies" : {
-    "vibe-d:core" : "~>0.8.0-beta.6",
+    "vibe-d:core" : ">=0.8.0-beta.6 <0.10.0",
     "vibe-d:data" : "*",
     "vibe-d:http" : "*",
     "vibe-d:web" : {
@@ -29,7 +29,7 @@
           "postBuildCommands": ["rm ut.d"],
           "mainSourceFile": "ut.d",
           "dependencies": {
-              "unit-threaded": "~>0.7.11"
+              "unit-threaded": ">=0.7.11"
           }
       }
   ],
diff --git a/source/oauth/provider/package.d b/source/oauth/provider/package.d
index 1dfda9e..12fceb9 100644
--- a/source/oauth/provider/package.d
+++ b/source/oauth/provider/package.d
@@ -44,9 +44,10 @@ class OAuthProvider
                                     ///     authorization redirect.
         tokenRequestHttpGet = 0x02, /// use the GET http method when requesting
                                     ///     an access token.
-        clientAuthParams    = 0x04  /// pass client credentials as parameters
+        clientAuthParams    = 0x04, /// pass client credentials as parameters
                                     ///     rather than using http Basic
                                     ///     authentication.
+        tokenResponseType   = 0x08, /// request access_token in authorization redirect.
     }
 
     /++
diff --git a/source/oauth/session.d b/source/oauth/session.d
index be44099..bb73b41 100644
--- a/source/oauth/session.d
+++ b/source/oauth/session.d
@@ -377,7 +377,7 @@ class OAuthSession
         return default_;
     }
 
-    struct SaveData
+    protected struct SaveData
     {
         SysTime timestamp;
         Json tokenData;
diff --git a/source/oauth/settings.d b/source/oauth/settings.d
index 0cacce8..8a0ae40 100644
--- a/source/oauth/settings.d
+++ b/source/oauth/settings.d
@@ -194,9 +194,9 @@ class OAuthSettings
         foreach (k, v; extraParams)
             reqParams[k] = v;
 
-        // Request an authorization code from the OAuth server. Subsequently,
-        // the authorization code may be exchanged for an access token.
-        reqParams["response_type"] = "code";
+        reqParams["response_type"] =
+            (provider.options & OAuthProvider.Option.tokenResponseType) ? "token" : "code";
+
         reqParams["client_id"] = clientId;
 
         if (provider.options & OAuthProvider.Option.explicitRedirectUri)