WIP oauth2-upgrade: oauth2 upgrade and REST fixes

You can completely remove ``bound_instance_``.

This is quite tricky. Decorated functions can be both bound and unbound depending on where the decorator is used. However with the refactoring you did, you can just rely on ``*args, **kwargs``.