Add initial spec for auth service

This is a draft based on some combined ideas from the OAuth toy code bases that have been used for experimentation:  https://github.com/mark-burnett/oauth-skeleton and https://github.com/iferguson90/oauth-toy.

It is not complete and may require significant changes to get it closer to what we want.
Well, the OAuth spec says that "the authorization server informs the client" of the error by adding additional information into the query string of the `redirect_uri` (section 4.1.2.1), so it's one of the status codes that should be raised for certain kinds of errors.