Move oauth token auth into auth plugin
Add csrf, session, login and grant flows