Implements Client Management Endpoints

We already had the R of CRUD, this adds the other 3. The 3 new endpoints require an oauth token with the scope `oauth`. Yo dawg, I heard you like oauth?

@rfk r?
@vladikoff you should take a look and see if there's something I've forgotten that the console will need.

fixes #60 
The profile server uses `403 Forbidden` rather than `401` in a similar context, so I think we should be consistent with that.

Personally I like having both `401 Unauthorized` and `403 Forbidden`, the former for "there's something wrong with your credentials" and the later for "your credentials are fine, but they don't grant that permission".