make decodeAuthorizationHeader() much more conservative.
allow a name regexp to be passed into decodeAuthorizationHeader.
scratch that regexp, make it take a hash of required/optional params.
allow paramInfo to take RegExp instances.
more complex validation criteria is now accepted.
rename paramInfo to validationCriteria.
added notBadOAuthRequestMiddleware, for lack of a better name.