SSO OAuth support

Add sso, accesstoken scopes
Add oauth_client_id field to Authorization
Implement oauth_controller
Override how bearer tokens are extracted for access_code
Return errors other than client_id or redirect_uri
Update tests