We must allow the system to operate on only user_id since we can retrieve everything else from the DB.
Properly handle Oauth exceptions from the authentication manager. These exception do not extend AuthenticationException
Unit tests
Do not allow any token with oauth.* to penetrate endpoints only meant for login server
This prevents a token with oauth.something to generate a token without a client secret or user password

https://www.pivotaltracker.com/story/show/74086514
[#74086514]
Close loophole where you could get a token if you had audience=oauth for an endpoint meant for login-server
https://www.pivotaltracker.com/story/show/74086514
[#74086514]
Add in unit tests for expansion of client authentication methods
https://www.pivotaltracker.com/story/show/74570302
[#74570302]
Merge branch 'feature/fix_oauth_anything_loop_hole' into develop