WIP oauth2-upgrade: oauth2 upgrade and REST fixes

I think it's wrong to pass ``request.oauth``.

``f(bound_instance_, request.oauth, *args, **kwargs)`` -> ``f(*args, **kwargs)``