Blank out scopes arg in token endpoint.
Update authorization.py - use the _create_request method and change request.oauth_token attribute to resource_owner_key

The Request() constructor doesn't give the request.oauth_token attribute that the create_authorization_response relies on. The _create_request() method doesn't either, but it gives something equivalent.
Made sure all endpoints used the self._create_request() method and referred to request.resource_owner_key instead of request.oauth_token
Changed access_token.py - validate_access_token_request passes the resource owner key as an access token, which doesn't yet exist, instead of a request token
Changed exception message in authorization.py; changed a validation parameter in resource.py from request_token to access_token; updated authors
Add star to the set of safe characters in urls
Merge pull request #198 from kumy/master

Add star to the set of safe characters in urls
Merge branch 'patch-1' of https://github.com/kdazzle/oauthlib into kdazzle-patch-1
Test for correct nonce_checking across endpoints.
0.5.1
The authorization endpoint now returns a 200 on "oob" oauth_callbacks.
Updated flask server example.
Added tests.
Fix for python3.
Fixed flask server example.
#199 Proposed API changes for endpoints.
Fixed error in example, added myself to authors.
#200 First attempt at API cleanup to match OAuth1.
OAuth1 endpoint documentation cleanup.
Document possibility and handling  of oob callback in get_redirect_uri.