Fix bearer token transfer issue.

See alphagov/signonotron2#245 for more details.

This change includes a refactor of the bearer token strategy to use [warden-oauth2](https://github.com/opperator/warden-oauth2).
Thanks for that.  I'm going to add doing matrix builds to our backlog.  I don't think it should hold up this PR though.