Adds doorkeeper to allow application to authenticate against huginn

This should help with #626, it also has the benefit that users do not need to share their username and password with any third party application that needs to access the huginn instance.

Since we probably can not keep the application `secret` secret I think we should automatically add every known application that is able to use huginn via a migration.

At the moment you need to access `<your huginn instance>/oauth/applications` and add the application manually.
Sorry, for going back and forth on this one, it's hard to find a solution which is secure (enough) and user friendly.

> These are basically oAuth access tokens,

After reading the doorkeeper code I think oAuth with shared client secrets would be as secure as issuing access_tokens. And it looks to me doorkeeper is vulnerable to timing attacks too, so I guess if they don't care we do not need to either :smile:

If we would go with oAuth and pre-generated applications the user could use the oAuth flow without having to copy the token. For additional security third party applications could support entering (or using a QR code with a custom url scheme) a custom client_id and secret.

For user that do not want to use the oAuth flow we could offer a button to generate an auth_token.

I kind of like the oAtuh flow to authenticate, but with timing attack just being a theoretical issue (or one nobody seems to care about enough), I would also be fine with a simple token based approach.