Lack of documentation for the deny_by_default flag

I had to really dig in order to find the proper name for the Controller as well as the fact that login is a `token` action.. I hope this helps others using both OAuth 2.0 and `Deny_by_Default => true` .