Fix bearer token transfer issue.

See alphagov/signonotron2#245 for more details.

This change includes a refactor of the bearer token strategy to use [warden-oauth2](https://github.com/opperator/warden-oauth2).
Ack...  This is a problem because the test suite has a tighter dependency on Rails than we have at runtime...  I'll see if I can find a way to work around this.