Oauth trust levels

This creates three 'trust levels' for OAuth applications based #107. It also allows a `max_scope` to be set for each application, allowing the types of scopes requested by them to be restricted. 

When an application asks for a scope or uses a grant type it is not allowed to use a `400 Bad Request is returned`.

I'm working on adding an admin interface for applications. 
I'm not sure why doorkeeper uses request.parameters. Nothing broke when I changed it. I may look at sending a PR. 

In this case, I just needed to mutate the params hash, and changing the request.parameters wasn't working correctly.