Add config to pass on token scope-change warnings

[jstevans]

This provides a more-explicit fix for #287

• we call requests_oauthlib.OAuth2Session#fetch_token which
  • calls oauthlib.oauth2.WebApplicationClient#parse_request_body_response which
  • is actually oauthlib.oauth2.rfc6749.clients.Client#parse_request_body_response which
    • calls oauthlib.oauth2.rfc6749.parameters.parse_token_response which
    • emits a Warning on changed scopes, complete with the parsed token
    • sets self.token * calls self.populate_token_attributes
  • sets self.token which
    • sets the WebApplicationClient's token again, and calls its populate_token_attributes again
  • returns self.token

Since we get exactly the same token in the warning, and the original commit's message suggests the warning is optional, it seems as though we can just do session.token = e.token (whose setter calls the necessary follow-on logic) and continue as usual.