mod_http_oauth2: Separate extracting credentials from requests and verifying The token endpoint also uses Basic auth, but the password would be the client_secret, so we need to verify against that instead of using test_password(). Splitting this up here avoids code duplication. Possibly this new function could go into util.http...

--% conflicts: mod_bookmarks
module:log("info", "mod_bookmarks has been deprecated, now loading mod_bookmarks2")
module:depends("bookmarks2")