Stop raising every client error as `invalid_credentials`

When a user declines logging in with a certain provider, the error message will change to `user_denied` or `access_denied`, depending on the provider.

When a CSRF attack is detected, the error message will also change to `csrf_detected`.

Fixes https://github.com/mkdynamic/omniauth-facebook/issues/124 and https://github.com/intridea/omniauth/issues/658 and every other `omniauth-oauth2` gem.