clearly show that 3 legged oauth is not required (bug 866176)

* add in a clear way for a user landing on the API page to distinguish between 2 and 3 legged oauth
* give a clear example that you can copy and paste right away
with [this approach](https://github.com/mozilla/zamboni/blob/d30ce6c/mkt/developers/forms_payments.py#L449-L454) the error is on the field not the form's non-field errors. or am I missing something?