include auth links
only use oauth when a client is provided; fix urn
use root links to find credentials endpoints; add a destroy-cred method
Globally fix hypermedia type
Blacklist what gets PUT back to the PMP

The pmp seems to bomb if implicit attributes are explicitly PUT back.  This
will get fixed sometime in the future, but for now, follow the path of other
SDK's and blacklist them.
Allow attributes with the same name as links to be PUT back.

When trying to PUT attributes.auth.user, this line kept causing it to be
removed when the json was rendered.  Since we're not blacklisting the things
we can't PUT back, should be able to remove this.
Update fixtures
merged PR 5 from cavis
Merge branch 'cavis-master'