clearly show that 3 legged oauth is not required (bug 866176)

* add in a clear way for a user landing on the API page to distinguish between 2 and 3 legged oauth
* give a clear example that you can copy and paste right away
how about testing the success case for `oauth_leg` with a valid app name and redirect URI?