First party login

Hey all, this should handle user login and retrieving the OAuth token for sites on the *.zooniverse.org domain. 

Basically the main thrust is that it allows a devise session cookie to be substituted for users credentials when making a request to the `/oauth/token` endpoint. So if a client is on a *.zooniverse.org domain, and a user is signed in using devise sending a request like...

```json
{
   "grant_type": "password",
   "client_id": "asdk;fja;sdfqwklj;laskdfja;sdlfkj..."
}
```

...returns a fully scoped OAuth token for the site. 

It also adds support for managing a devise session over JSON.  

The only caveat is all of those endpoints need to use Rails's CSRF protection features to prevent a third-party site from ohijacking a users's session and getting free oauth tokens. Therefore the javascript client will need to look for the `X-CSRF-Param` and `X-CSRF-Token` headers and respond with a `X-CSRF-Token` header.
Is that just because we're not going to be sending the client_secret in normal usage?