Add grant approval, scope.Add, ClientAuthorization update, unit tests

Gorilla looks to be calling http://golang.org/src/pkg/net/http/cookie.go?s=2932:2980#L119 which calls Add-Cookie - so if you save session twice you'll get two headers.  The latter *should* override the former, but it's certainly ugly.  Let's create an issue to track this.