clearly show that 3 legged oauth is not required (bug 866176)

* add in a clear way for a user landing on the API page to distinguish between 2 and 3 legged oauth
* give a clear example that you can copy and paste right away
`assert form.is_valid(), form.errors`