authenticationCallback is dependent on oauth/token

- no longer pass user.
- injected into /oauth/token calls
Clean up authentication state.

- Unauthenticated/Authenticated based purely on credential.
- Authenticating based on /oauth/token calls
2.0.0 changelog