The great authenticate-oauth cleanup

AFAICS, this PR subsumes #32, #34, #36, #37 and #38.  @snoyberg, what do you think?