Substantially rewrite the OAuth2 workflow doc.