Add unit test for OAuthToken.
Fix security issue in linkAccount.

As described in issue #7, it was possible to link an OAuth account to *any*
internal account if the ID of the user record was known (or guessed). The
`linkAccount` action now requires either a username/password combination or
an authenticated user with a principal of type `long` in order to complete
the linking.
Add warning on installation about breaking change.
Update plugin version to 0.3.