IN-630 & IN-641: Updates to oauth provider codebase

**IN-630: The updates have been done for the following 2 reasons:**
1. Include the option of skipping the consent screen: For a particluar tenant, the user consent screen has been designed to be optional. This helps in cases like the  Rails tenant where an explicit tenant is not really required. Hence, this parameter has been implemented as a client level parameter which can be skipped if the flag is set to "true"
2. Refresh token timeout reset: To implement session expiry, if the refresh token is not yet expired, then the timeout is refreshed to its original value to keep the session alive and expire only on idle timeout.

**IN-641: Adding req parameter to user.js method:**
The req parameter is required to be compatible with the multi-tenant nature of the usecase. Since the req parameter is used to construct the tenant for each request, without it finding out the user is not possible.

**IN-641: Adding support for substring matching for redirect_uri:**
redirect_uri has been updated to do a substring match to verify the part of the client's redirect_uri to support multi-tenancy. This approach is acceptable as per the RFC.

**IN-641: Changing fetchFromRequest & checkPassword user model methods to use callback approach:**
This change is needed as querying into MongoDB after constructing the authenticator from the req is an asynchronous operation.
The approach these methods followed expected synchronous results.
Hence, changed the methods to use the asynchronous model.

**IN-641: Added req parameter to access_token & refresh_token save methods:**
This is needed to have option to customize the time to live on a per tenant basis.
Without the req parameter being passes, it is not possible to distinguish the tenants when saving the access_token and refresh_token.

**IN-641: Updated the refresh_token refresh method to include the req parameter and the userId and clientId in the method signature**