WIP oauth2-upgrade: oauth2 upgrade and REST fixes

and  ``"/oauth/invalid/"`` -> ``url_for('oauth2server.invalid')``