provide 'req' as first arg to getSecrets().
factored out oauthTokenMiddleware.
finished access_token endpoint, implemented trivial acct settings endpoint.