Auth provider cleanup

Sorry for a messy pull request, it's my first time :) Will try to break down the major changes I made here:

 1. Access Tokens are not persisted into database now. Instead tickets issuing logic is factored out to `AuthenticationTicketProvider` and reused in both `SimpleAuthorizationServerProvider` and `SimpleRefreshTokenProvider`. This was done because of: **a)** security reasons (`ProtectedTicket` was actually a valid `access_token` that could be reaused to access resource server); **b)** allowing changes in machineKey without any necessity to update database.

 2. Allowing multiple sessions for single user on different browsers or machines. `SessionId` column added to `RefreshToken` entity which is generated per each password grant flow. Previously it was impossible to keep user logged in with refresh token on 2 different machines or 2 different browsers simultaneously, now every time user enters credentials a separate record with unique `SessionId` would be created in `RefreshTokens` table without affecting other sessions.

 3. Allow Origin logic factored out to `Owin.Cors` middlware. This allows to handle `OPTIONS` request correnctly. Previously they would be rejected by `Owin.OAuth` middleware.