Allow different post-ORCID login behaviors

[pkalita-lbl]

These changes add a behavior query parameter to the existing /login and /token endpoints in order to change the behavior of what happens to the token after authenticating with ORCID. The default, web, retains the current behavior: store the token in a session cookie and redirect to the home page. The new ones are:

• jwt which just returns a plain string response of the token
• app which redirects to the app's token collection page (the hostname is configurable with a new variable here) with the token in a query parameter

At Shreyas's suggestion I did look to see if we could avoid re-encoding the token after the authorize_access_token function automatically decodes it, but nothing really jumped out to me. As far as I can tell the re-encoding isn't hurting anything so I'm inclined to just let it be.

[naglepuff]

No major issues here, but I did have one concern about a change to get_token.