Oauth dependences upate v2

[simonx1]

There is a dependency that may be updated.

[isaacsanders]

@simonx1 Can you show me an example of why we'd want to remove the _method param?

[dgpokl]

Unless you can demonstrate the need for the request params, I will have to reject this. I would accept a PR for just the omniauth dependency update.

Not PR author, but I think this is the reasoning:

• The only change in omniauth 2.0 is that you aren't allowed to do login actions as GETs anymore due to... security CSRF stuff. This was CVE-2015-9284.
• Allowing someone to pass _method would allow them to do a GET and include _method=post so that it would be treated as a POST, which defeats the purpose of the whole thing.

Again I can't personally guarantee that dropping that param here is definitely needed as I'm not an expert on this library or omniauth, however I think that's at least the rationale.

[isaacsanders]

@dgpokl works for me