Require auth for token route.
Merge remote-tracking branch 'origin/master'
More oauth functionality refinement.  Working, but not complete.