Oauth tidy up

Made the OAuthInterceptor easier to follow.

AuthController no longer assumes a user is present. Whilst they should be, according to the OAuthInterceptor, there are cases where they're not, which we can't yet get to the bottom of.
One step at a time; I just changed the method from conditional to a guard. Will have a play, though :)