Delegated superuser API access

Add a new scope for SUPERUSER that allows delegated access to the superuser endpoints. CA needs this so they can programmatically create and remove users.

endpoints/api/__init__.py

@@ -308,6 +308,10 @@ def require_fresh_login(func):
     if not user:
       raise Unauthorized()
 
+    oauth_token = get_validated_oauth_token()
+    if oauth_token:
+      return func(*args, **kwargs)
+
     logger.debug('Checking fresh login for user %s', user.username)
 
     last_login = session.get('login_time', datetime.datetime.min)