Credentials fixes

* update URNs
* update hypermedia type `application/vnd.collection.doc+json`
* don't require oauth to fetch root document
* use auth links for credentials endpoints (there's currently not a "list-creds" link though ... maybe that should be added at some point)
* blacklist what gets `PUT` back - including things like `attributes.created`, `attributes.modified` causes the PMP to bomb.  Will fix this on the PMP side at some point, but for now, follow the path of other SDK's and blacklist these.
* allow `attributes.auth.user` to be included in the `PUT` json data