OAuth cleanup round... 5?

OAuth smoke and mirror indirection is coming to an end. Through tracing code, I've found that we only actually issue Bearer tokens. I've renamed accordingly, and flattened a complex cache mapping. There's at least one more cleanup round to do, but this should be the last api-breaker

TODO for implementors (aka @ccustine)
 * Use OAuthModule, not OAuthAuthenticationModule
 * Use OAuthFilter, not OAuthAuthenticationFilter
 * else is the same

Details.
 * Refactor OAuth to be less complex.
 * Remove OAuth as a registered api. 
 * Rename redundant OAuthAuthenticationFilter to OAuthFilter.