[WIP] Upgrade to oauthlib 0.6.1 (bug 917040)

https://bugzilla.mozilla.org/show_bug.cgi?id=917040

WIP, need eyes familiar with our OAuth code and/or oauthlib. 

2-legged auth is completely broken atm, because passing `require_resource_owner=False` doesn't seem possible anymore. We don't have specific tests for this (booh) but all the API tests are using 2-legged oauth1, so they pretty much all break.