clearly show that 3 legged oauth is not required (bug 866176)

* add in a clear way for a user landing on the API page to distinguish between 2 and 3 legged oauth
* give a clear example that you can copy and paste right away
instead of doing these conditional validation checks in the main `clean` method, could you just make these fields required in `__init__` if `self.data['oauth_leg'] == 'website'` à la [this form](https://github.com/mozilla/zamboni/blob/d30ce6c/mkt/developers/forms_payments.py#L449-L454)?