OAuth base class

1. This abstracts common protocol operations into a series of base classes (see Facebook, Google, Microsoft), reducing duplicate code and making it easier to implement other providers.
2. The base class can be used directly to access other auth providers. See the GitHub sample in Startup.cs. Because resolving user information is not part of the OAuth protocol, that step must be left to the developer (see OnGetUserInformationAsync notification). If they don't, by default we will put the access token into the ClaimsIdentity for the application to utilize later.
Good idea, even if we don't precisely know why FB decided to used comma-separated scopes (FB is known to implement an older draft of OAuth2, but even in the oldest drafts, the scope has always been space-separated).

The following references could be listed though:

https://developers.facebook.com/docs/reference/dialogs/oauth
> scope: a comma separated list of permission names which you would like people to grant your app. Only the permissions people have not already granted your app will be shown

http://tools.ietf.org/html/rfc6749#section-3.3
>   The value of the scope parameter is expressed as a list of space-
   delimited, case-sensitive strings.  The strings are defined by the
   authorization server.  If the value contains multiple space-delimited
   strings, their order does not matter, and each string adds an
   additional access range to the requested scope.