Rack::Attack should treat /oauth endpoints as API endpoints

/oauth/* endpoint are not covered by Rack::Attack because only paths starting with api are considered API endpoint.

Proposal: OAuth endpoints should be considered API endpoints.