Make auth interfaces more flexible

Allow AuthenticationNeeded/GrantNeeded interfaces to decide whether to handle the request, or let the default error response be written by the oauth server
No need for named return values.  I like knowing what they are in function definition, but I think being to accidentally have bare returns is more painful than having to look at docs.