Refactor OAuth so that it doesn't require private keys when we aren't signing anything

Now, we can safely use bearer tokens or "none" alg without guice crapping out. I also refactored naming of things.

As always in this api, there's more shoveling to do, but this is certainly a step forwards cognitively and also from a tech debt pov.

replaces #87