Authorizing user should propose roles to delegate for OAuth

Currently in the oauth1 extension the consumer specifies roles
instead of delegator. This is a design fault that should be fixed
by having the authorizing user provide a set of roles (ids)
during the authorize request token phase

fixes bug: #1216408

Change-Id: I696306b0679c9982267a1d8da1bfb1266c8e6a6d