Make auth interfaces more flexible

Allow AuthenticationNeeded/GrantNeeded interfaces to decide whether to handle the request, or let the default error response be written by the oauth server
osinserver.ErrorHandler is the top level handler, so it has to write the response
this handler can write the response, swallow the error, or kick the error back up the chain