oauth2: Don't parse the DOM to detect access_denied

Compliant OAuth2 implementations should return access_denied if the
user denied access through the embedded web view. We should look for
this instead of parsing the DOM whenever possible, because DOMs are
fragile and can be changed at will on the server-side.

See 4.1.2.1 for more information on the error codes:
https://tools.ietf.org/html/draft-ietf-oauth-v2-23

Google, Facebook and Windows Live have compliant implementations.

Fixes: https://bugzilla.gnome.org/709570