Protect oauth controller calls and update policy.json

We need to call controller.protected for most of the oauth_calls.
With the exception of the public ones (create_request_token,
create_access_token, and authenticate_access_token).
Also need to update the policy.json accordingly.

fixes bug 1231709

Change-Id: Ica111aa3ed82499d2de50d472754a0b5b3c5cc71
Merge "Protect oauth controller calls and update policy.json"