Use requests-oauthlib instead of oauth2.

Some notes:
- This means that if something doesn't work, it's way harder to figure out why.  On the other hand, maybe things will be more likely to always work, because we're using someone else's code.
- requests-oauthlib was intended for three-participant OAuth, so in order to use it with our two-participant OAuth (and with auto-relogin), we have to use it somewhat differently, changing some internal variables and things.
- There are no tests for 'proxies' using OAuth (there are no tests for proxies using regular auth either, but presumably someone used it at some point).
- Regular auth is implemented on an auth object, whereas OAuth is implemented on a session object, so in order for the client to be able to treat them in the same way, there is a dummy OAuth 'auth' object.