Clean up request class heirarchy

Removed setters from BaseRequest, removed serialization helpers from OAuth2Request, added comments to more explicitly call out what each class is to be used for.