Fix JSON array helper to correctly render a JSON hash as an array

* the `json` method encapsulated hash generation and rendering, which
  made `json_array` incorrectly render.
* moved hash generation into its own method, which is called by both
  `json` and `json_array`
Remove ID from "avatar" object in User Resource

* The Avatar's ID is not useful for the API consumers since they do
  not use it to interact with the user's avatar.
  * Avatar updating is handled through the `Current User` resource, &
    the avatar's URL is used to download/present the avatar.
The OAuth Authorizations API requires a subdomain to CRUD tokens

* Basic Authentication only supports 2 parameters: name and password
  (In our case, it is email and password/API token)
  * A user (email/psw combo) can be associated with multiple Freckle
    accounts, and the privacy of each account's data must be preserved
    * e.g: If I authorize an application to use my personal account,
      it should not have access to my work account.
  * To keep accounts separate and their data private, API consumers
    must indicate which subdomain they are attempting to access to
    list, create, update, or destroy an OAuth Access Token.
    * A special method is provided to list all of the subdomains
      associated with this user, along with their avatar URLs.
    * If the user is not associated with the subdomain provided (or it
      does not exist), then a 404 error is returned.
    * the desired subdomain is kept as a URL parameter to preserve
      correct HTTP verbage. Otherwise, every method would have to be a
      POST request (in order to pass the subdomain).
  * Included a notice that Access Tokens are not shared across
    accounts, and the ideal steps for using the OAuth Authorizations
    API for the user-specified account.
Move OAuth methods used by applications into their own section

* These methods include:
  * checking that an Access Token is valid
  * revoking tokens as necessary
* Used to managed the application, not to interact with the account's
  data.