Add initial spec for auth service

This is a draft based on some combined ideas from the OAuth toy code bases that have been used for experimentation:  https://github.com/mark-burnett/oauth-skeleton and https://github.com/iferguson90/oauth-toy.

It is not complete and may require significant changes to get it closer to what we want.
Is 302 (found) an error?