Add basic X-MESSENGER-OAUTH2 support

This does not do the OAuth dance (which pretty much requires a browser), so the using application must provide the access token.