Use the X-Forwarded-Proto header to deduce right scheme for decoding OAuth messages

If the Nuxeo is behind a load balancer that taker care of SSL encription, OAuth messages are passed with the HTTPS scheme. When decoding the message the nuxeo server makes the challenge with an http scheme that fails.

We can make use of the de-facto standard X-Forwarded-Proto header to check if the scheme is the right one.