Implement OAuth authorization endpoint for first-party accounts

[robertknight]

Implement an OAuth authorization endpoint that allows users to grant browser-based clients access to data in their Hypothesis accounts.

For context and design discussion, see Client OAuth Login Technical Design.

Acceptance criteria

1. There is an endpoint, provisionally at GET /oauth/authorize, which clients can open in a popup window in order to authorize the client to access the user's data on Hypothesis.
2. When a pre-registered client directs the user to this endpoint, the endpoint verifies the client ID and reports an error if it is unrecognized.
3. If the user is logged in to the service when they visit this endpoint, they are prompted to allow the client to Accept / Deny the client access to the user's data.
4. If the user is not logged in, they are first shown the login form and then sent to step 3.
5. After the user accepts, an auth code is generated and delivered back to the client as described in the design document.
6. If the user rejects or closes the auth prompt, an error is delivered back to the client as described in the design doc.