OAuth 2.0 documentation

Rewrite authentication documentation to mainly discuss OAuth 2.0. Other authentication mechanisms are secondary and should not be used for public-facing apps.