Add OAuth details

I wrote this document a few months ago for a conversation with some of our security advisors. It seems to make more sense to have it in this repo than buried away in Google Drive.

It could almost certainly do with some more attention to make it more useful/readable, but getting it out there's a first step...