add signing

drop simple oauth, verify on our own. fixes things that are not done correctly in the simple oauth gem:

- misparsing query parameters which do not include an '=' (these are discarded; oauth spec mandates they are included with an empty value)
- doing any parsing at all of form encoded bodies (simple oauth relies on the caller to do this in a manner consistent with the oauth spec, which is hopelessly optimistic and shirking a responsibility that should be on it)
- handling duplicated protocol parameters in the Authorization header (simple oauth does not detect these; oauth spec requires the request be considered invalid)
- consistently handling commas in quoted values in the Authorization header (simple oauth just blows up)
- not differentiating between Authorization parameters which begin with 'oauth_' and those that don't 
- creating arbitrary user-supplied symbols

in addition:
- document everything (simple oauth has never even heard of documentation) 
- test most everything, in particular using the examples from the oauth spec

to do (this PR):
- finish the rest of the tests
- simple oauth is still used in the tests, rip that out

note that this does not include body hash, that is in another branch coming up when this is merged (this PR is quite big enough as is, I think)

@edan