Review: Remove UID match comment
Add oauth client and grant interfaces, authorize/access handlers

Authorize request handlers (authn/grant enforcement)
Access handlers (password, assertion, client checks)
Test registering API REST resources