Don't check OAuth tokens on non-api requests

We used to always validate OAuth tokens if an Authorization header was
supplied in the request, except for calls to Special:OAuth, since those
could use request tokens, which wouldn't validate in a normal check.

This only does the check on API calls, since that's the only way users
should use OAuth.

Change-Id: I573ba252ff27e4c5201d34117cd907471e60c2e8