OAuth2Provider and OAuth2AsyncProvider traits now take RequestHeader

... instead of Request to issueAccessToken and authorize methods.

By making this change these traits can now be used in places where we only have a RequestHeader object, such as overriding onHandlerNotFound in GlobalSettings.  This allows us to check that the user is authorized, even when they request a non-existent URL, thus hiding which URLs are available to not authenticated users.