Fix bearer token transfer issue.

See alphagov/signonotron2#245 for more details.

This change includes a refactor of the bearer token strategy to use [warden-oauth2](https://github.com/opperator/warden-oauth2).
I've just spotted that this is triggering a warning when running `bundle` because Rails is now declared as a dependency twice. Here is the message:
```

gds-sso at /var/govuk/gds-sso did not have a valid gemspec.
This prevents bundler from installing bins or native extensions, but that may not affect its functionality.
The validation message from Rubygems was:
  duplicate dependency on rails (~> 3.2.19, development), (>= 3.0.0) use:
    add_runtime_dependency 'rails', '~> 3.2.19', '>= 3.0.0'
```