OAuth authentication

Added support for the "Client Credentials Grant" of the OAuth 2 spec.
This will allow tenant administrators to register a client either for themselves
or a user they trust. Once a client has been setup for a user, anyone who has
the client id/secret will be able to interact with OAE on behalf of that user.

This was created with the "Authorization Code Grant" in mind, so we should be able
to support the more typical OAuth flow (webapp redirects to OAE, user grants webapp,
OAE redirects back to webapp) as well.
Added the HTTP bearer and oauth2-client passport dependencies
Cleaned up OAuth strategy and added updateClient logic

 * Added update client REST endpoint
 * Moved dao into internal/ folder
 * Created model.js
 * Using PrincipalsDAO rather than API to retrieve user
 * Test: change config rather than import csv to test tenant admin capabilities
 * Couple of code cleanup fixes
OAuth - PR followup

 * camelCased column family names
 * Cleaned up code
 * Merged CSRF test with another test
Merge pull request #772 from simong/oauth

OAuth authentication