Adds doorkeeper to allow application to authenticate against huginn

This should help with #626, it also has the benefit that users do not need to share their username and password with any third party application that needs to access the huginn instance.

Since we probably can not keep the application `secret` secret I think we should automatically add every known application that is able to use huginn via a migration.

At the moment you need to access `<your huginn instance>/oauth/applications` and add the application manually.
Seems reasonable, but you wouldn't want to use bcrypt, though, at least not on every request, because it'd be too slow.  This is why oauth2 uses expiring access tokens and refresh tokens, I think.  If someone has hacked your Huginn and stolen your API keys, hasn't all of your data been compromised anyway?  Given that, I'm not sure there's any reason to store only the hash instead of the full key, since it's not like you'll be reusing it on other sites, like you might be with a password.  What do you think?