Oauth login.

* Add set_access_credentials to explicitly set access_token and
   refresh_token.
 * Add set_oauth_app_info to explictly set app info / retrieve
   it from the configuration file.
 * Stop retrieving the app info from the configuration file to make
   these variables changeable.

This will make oauth login similair to regular login, but mutually exclusive. It allows app info and credentials to be changed more easily and sets `r.user` when setting access credentials. But at the same time also recover gracefully if the scope of oauth doesn't include `identity`. A 403 error will only be given if we are authenticated as the user, but lack `identity` scope. For bad access token it will give a 401.