Asset bundle override plumbing

Use asset specs for the asset bundle yaml definition files so that
the file from h is included by reference, but include a local one
that takes priority and configures a different auth bundle.
Switch back to using the h session-based oauth
Override h.auth asset bundle and blocks.pt