Ability for a user on web2 to log in with a username/password.

This PR allows the api to authenticate an OAuth password grant type request. It is only intended for use with the web2 application.

The request is handled within a new controller called TokenController, with the work done in OAuthModel's createAccessTokenFromPassword(). It's likely that createAccessTokenFromPassword will need refactoring as I'm not completely convinced that expiring out of date tokens should be there.

I've also introduced a config.php file that will need to be created on live and test which stores the list of client ids that are allowed to log in via username/password. I decided on a config file as it will make set up of a local api/web2 combo easier for new contributors while also allowing us to change the id for the live system if we need to.

Note also that, while it's not used at the moment anywhere else, every controller now has access to the config array.