Implement OAUTHBEARER from RFC 7628

[Zash]

Untested. Draft-PR hoping for API feedback.

The OAUTHBEARER mechanism is weird and backwards, thus the API will have to be awkward and annoying. You start by sending the token, which you don't have yet, nor know where to retrieve it from. Then the server sends you a challenge with some JSON that includes the URL where you would discover this from. Then you can do the OAuth dance, retrieve your token and start over from the beginning.

The credentials callback would likely look something like:

def credentials(stuff):
    if stuff is None:
        return ('', {'auth':'Bearer Idontknowyet'})
    if 'openid-configuration' in stuff:
        # Do the dance. Get the token.
        return ('', {'auth':'Bearer reallysecrettokenhere'})