Let authenticateToken hooks set req properties.

Previously, we had authenticateToken call back with a username or client ID, and then Restify–OAuth2 would set appropriate properties on the request object for routes to later check. Since we are now exposing the request to the authenticateToken hook, we might as well let the hook set those properties directly. This should address any complaints (e.g. #13) about the property names not being configurable.

This is also helpful for scope support (#17) since now we don't have to have authenticateToken call back with multiple parameters.
Add scope support.

This introduces a new optional hook, `grantScopes`, which allows you to authenticate a given set of scopes.