#000 - Fix authorization for other oauth routes.

Earlier, /oauth/authorize, /oauth/user_tokens and /oauth/user_tokens/revoke/:token_id
were all authorized by ROLE_USER. As with the earlier commit, now that they are all
prefixed by /admin, the catch-all /admin/**=ROLE_SUPERVISOR rule kicks in for them.

But, they should be ROLE_USER as earlier.