support token Credential and open up cstor

allows providing oauth tokens, but does not solve the bigger issues of
refresh/signin

- make Credential's constructor public so that arbitrary Authorization
  schemes are supported.
- explicitly add static Credential.oauth method with bearer and token
  params

fixes #497