Implementing requests_oauth session object

The REST API client now uses an OAuth2Session instead of a normal
requests Session. This means a lot of the oauth specifics can be pushed
down to the session rather than dealt with in the client directly. It
also means that, given a refresh token, the client can automatically
refresh access tokens.