Hooks to tie OAuth in with User rights and the API

** WIP, do not merge yet **

This is a draft of appropriate hooks to have the User object created for
the session to have its rights adjusted based on the OAuth grants,
without having all other User objects also affected (because that would
break stuff like ApiQueryUsers).

Note this is a rough draft and still needs testing and security review,
and the implementation may change greatly by the time that's done.

Change-Id: I8e9784b2bf4e5b85b5a691a3354e421381ae75b3