Add endpoint to log in with OAuth access token

@aleffert @rlucioni 

FYI @nasthagiri @dianakhuang @johncox-google

I dislike the fact that we have to poke the session to pass information to the pipeline. I'm wondering if we should change parse_query_params to not require auth_entry to be set in the session (and instead pass is_api as a kwarg to the pipeline), but I haven't fully thought through the ramifications of that change. I'm also not at all tied to the format of the responses from the new endpoint. If you can think of something better, let me know.
It seems there are a couple of options here. One would be to raise an exception, which would bypass the partial pipeline saving mechanism. The other would be to have the caller use `clean_partial_pipeline`. I think the latter is a bit cleaner but increases the burden on the caller, which I don't like. Thoughts?