Make auth interfaces more flexible

Allow AuthenticationNeeded/GrantNeeded interfaces to decide whether to handle the request, or let the default error response be written by the oauth server
depends on whether you want all handlers to pass or any handler to pass. In our case, we want all to pass (we set up a chain to do authorize, verify grant). If we need the other behavior, we can make it an option