Add endpoint to log in with OAuth access token

@aleffert @rlucioni 

FYI @nasthagiri @dianakhuang @johncox-google

I dislike the fact that we have to poke the session to pass information to the pipeline. I'm wondering if we should change parse_query_params to not require auth_entry to be set in the session (and instead pass is_api as a kwarg to the pipeline), but I haven't fully thought through the ramifications of that change. I'm also not at all tied to the format of the responses from the new endpoint. If you can think of something better, let me know.
I'd prefer to see the caller use `clean_partial_pipeline`; I think raising an exception in this case would be an abuse.