[OAuth2] Implement Authorization Code Flow

[frol]

RFC 6749 section 4.1

This is the accessCode flow type in OpenAPI (Swagger) Specification.

This feature will require to have a page for authentication since we don't have cookie sessions on RESTful API by design, just like in #4.