Update brief-ietf-oauth2.md

Pulled recommendations from IETF privacy guidance and added Scenario 2. QUESTION: Should I also look at "Privacy Considerations for Internet Protocols" to fill out the "possible issues" section? http://tools.ietf.org/html/rfc6973