First party login

Hey all, this should handle user login and retrieving the OAuth token for sites on the *.zooniverse.org domain. 

Basically the main thrust is that it allows a devise session cookie to be substituted for users credentials when making a request to the `/oauth/token` endpoint. So if a client is on a *.zooniverse.org domain, and a user is signed in using devise sending a request like...

```json
{
   "grant_type": "password",
   "client_id": "asdk;fja;sdfqwklj;laskdfja;sdlfkj..."
}
```

...returns a fully scoped OAuth token for the site. 

It also adds support for managing a devise session over JSON.  

The only caveat is all of those endpoints need to use Rails's CSRF protection features to prevent a third-party site from ohijacking a users's session and getting free oauth tokens. Therefore the javascript client will need to look for the `X-CSRF-Param` and `X-CSRF-Token` headers and respond with a `X-CSRF-Token` header.
These provide all the route functionality for devise. We will need most of them (now we're offering HTML views for user control, etc) but routes like `GET /users/cancel` and `DELETE /users` are already implemented in the api user routes.

If we leave them as is then actual user delete functionality will exist and not the desired disable as we implemented via `DELETE /api/users/`. Previously I added just the routes we wanted to respond to, all others would raise a Routing Error.