A change to throw actual exceptions

When we're doing OAuth and the response code isn't 200OK, why shouldn't we return a proper exception to the client?  Without doing this, we have to parse client response, and it may not be something reasonable.

I'd make a test case, but that would require a working web server which returns bad responses.