Make the server the oauth2 client

[cameron-martin]

Currently the browser is the oauth2 client (as in section 6.3 of the IETF document). However, I want to switch to the server (next.js) being the oauth2 client, with a session maintained with the browser (as in section 6.2 of the IETF document). The main reason for this is so that the server can authenticate during SSR.

We can use API routes to proxy requests to the resource server. There's an example of doing cookie-based authentication.

Supercedes #19.