oAuth2 error message are cryptic

[XVincentX]

When something goes wrong with oAuth2, we return a 401 with a simple Unauthorized message.

This is probably good for a production environment; however in development mode we should return more meaningful error message to help the developer understand what's going on.

They can then be disabled when it runs in production mode.

Ideas:

1. Increase the logging when things go wrong
2. Return detailed error message in the response when something goes on and NODE_ENV is not on production.

Related to #701

[9horses]

Just a quick note that even in production, returning additional information for 401's would be useful.
Returning something in WWW-Authenticate header would be as per the standard as dictated here: https://tools.ietf.org/html/rfc6750#section-3