* start fiddling about with oauth server * start returning more helpful errors from oauth * test helpful(ish) token errors * add missing license header