Addressing comments in the previous commit:

- tokeinfo API responses are not cached because tokens can be revoked before
  expired;
- error_description from tokeninfo API error response bubbles up (if any)
- CurrentOAuthUser is not setting user ID to be consistent with JWT
- additional tokeninfo checks (email should be present and verified)