Oauth tidy up

Made the OAuthInterceptor easier to follow.

AuthController no longer assumes a user is present. Whilst they should be, according to the OAuthInterceptor, there are cases where they're not, which we can't yet get to the bottom of.
This condition is a bit difficult too read...is it worth to extract it in a well named method?