Improve workingness of OAuth flows

* Resource owner can now be properly determined
* Enable refresh tokens for auth code grants
* Don't need custom frame options, Rails 4 defaults to SAMEORIGIN
* Removed certificate message since CSH isn't self-signed anymore