rework oauth

Sanction actually makes things more complicated than it needs to be
When you look at the simplicity of the oauth protocol, better do its own implementation

Add e2e tests to verify that the negociation actually works against the real bearer

Signed-off-by: Pierre Tardy <tardyp@gmail.com>