Switching OAuth endpoints to return a 401 instead of a 302. Also handling mal-formed JSON in OAuth requests.