Authentication and authorization

This patch implements:

1. Registering [ORCID](http://orcid.org/) credentials via OAuth (user gives PeriodO permission to read her ORCID ID and we store it along with an access token).
2. [HTTP Bearer Authentication](https://tools.ietf.org/html/rfc6750) for submitting, updating and merging patches.
3. Checking permissions before authorizing any of the above actions, namely:
    * Any registered user can submit patches.
    * Only users with `accept-patch` permissions can accept patches.
    * Only the original submitter of a patch can update it.