Oauth tidy up

Made the OAuthInterceptor easier to follow.

AuthController no longer assumes a user is present. Whilst they should be, according to the OAuthInterceptor, there are cases where they're not, which we can't yet get to the bottom of.