Add API docs and OAuthify the endpoints.

I took a stab at appropriate OAuth scopes. Please feel free to suggest an alternate scheme.

:eyeglasses: @kemitche @Deimos