Fixed: Credential verification script does not reject invalid credentials

## Problem

The credential verification script only runs against passwords endpoint, including, for example, the admin/passwords and storage/passwords endpoints. We were running against a configuration endpoint--one that we invented: twitter-application.conf. Hence, the credential verification script failed to run.

## Resolution

I have reverted back to using the admin/passwords endpoint. Since passwords endpoints require a specific named triplet of fields and OAuth are based on a quadruple, changes to the setup.xml were required. Our admin/passwords endpoint fields are mapped to an OAuth credential as follows:

| Passwords field | OAuth field(s)                            | Setup element
|-----------------|-------------------------------------------|---------------------------------------------------------
| realm           | *<app_key>*                               | Consumer key
| user            | *<oauth_token>*                           | Access token
| password        | *<app_secret>***:***<oauth_token_secret>* | Consumer secret and access token secret, colon separated

A side benefit of this change is that secrets are a little better protected. Splunk guarantees that it will never print them. We might--but don't--and Splunk won't print them.

Signed-off-by: David Noble <dnoble@splunk.com>