clearly show that 3 legged oauth is not required (bug 866176)

* add in a clear way for a user landing on the API page to distinguish between 2 and 3 legged oauth
* give a clear example that you can copy and paste right away
why can't you just raise a `ValidationError`. having to import that `add_error` is kind of sad times.