make the auth class usable by third parties

- Provide methods for getting the authorize url and access token
- Use the mature oauthlib and requests_oauthlib libraries to simplify
- For security, use a state param and make sure the response matches
- Build the cherrypy server start into the browser_authorize method
- Rename the (now more generic) auth class to MisfitAuth
- Update the cli command to authorize instead of authenticate
- Add authorization instructions to the README