@user_hash token and refresh_token

I wanted to use sorcery as the authentication library with Oauth for external services, but needed to be able to access and store the user oauth token for use with other libraries, such as heroku's platform-api and github_api.

This commit does just that, by modifying get_user_hash to include the access_token token and refresh_token if present.

For example, if the authentications table is updated to include a field for token and refresh_token, a modified callback method on OauthsController can be used to update the authentication to include the token and refresh token for later use:

    def callback
      provider = params[:provider]
      unless @user = login_from(provider)
        if @user = User.find_by_email(@user_hash[:email])
          @user.add_provider_to_user(provider, @user_hash[:uid])
        elsif current_user && @user = current_user
          current_user.add_provider_to_user(provider, @user_hash[:uid])
        elsif @user = create_from(provider)
          reset_session
        end
      end
      if @user
        @user.send(provider).update_attributes(token: @user_hash[:token], refresh_token: @user_hash[:refresh_token])
        auto_login(@user)
        redirect_to root_path, :notice => "Logged in from #{provider.titleize}!"
      else
        redirect_to root_path, :alert => "Failed to login from #{provider.titleize}!"
      end
    end

I felt like this was an unobtrusive way of providing this potential functionality to those who need it, without adding undue burden on those who didn't.
Is there a reason to call `merge!` instead of `merge` here? This will mutate provided hash, which might not be expected.