Fix api POST oauth verification

Previously, our oauth implementation was checking 'request_parameters,'
which includes json bodies. This is invalid, since oauth only signs the
headers and query parameters. Fixed to not sign POST bodies, thus
allowing successful API posts.
Add nonce checks to oauth provider

Since the bodies of requests don't get signed, it is especially
important for POST actions to validate the nonce to avoid replay
attacks.

The oauth nonce is a random string in the signed headers whose purpose
is to prevent someone from using the signed headers of a valid request
to forge an invalid request, referred to as a replay attack. The
provider is supposed to store recently-seen nonces and reject any
requests where the nonce has been seen before. For logistical purposes,
the nonce check is implemented alongside a timestamp check so the
provider only has to store the last X minutes worth of nonces. We chose
15 minutes.
Rename spec/integration to spec/api

Our integration tests have lots of oauth and api specific stuff in them,
and don't much resemble traditional integration tests. This makes it
more clear/expected, IMO.