Add endpoint to log in with OAuth access token

@aleffert @rlucioni 

FYI @nasthagiri @dianakhuang @johncox-google

I dislike the fact that we have to poke the session to pass information to the pipeline. I'm wondering if we should change parse_query_params to not require auth_entry to be set in the session (and instead pass is_api as a kwarg to the pipeline), but I haven't fully thought through the ramifications of that change. I'm also not at all tied to the format of the responses from the new endpoint. If you can think of something better, let me know.
Have you considered supporting python duck typing here instead (to be more pythonic)?  In particular, instead of requiring a certain class hierarchy, simply check for a `do_auth` method on the `backend` object.  There are pluses and minuses of using duck typing, which can be considered for each case.