Downgrade omniauth-oauth2 dependency to ~>1.0, since 1.1 breaks client side auth workflows

See https://github.com/intridea/omniauth-oauth2/issues/20