pygitweb: oauth users now get a passwordless local account to map their keys
* oauth sessions are mapped by e-mail only
* oauth sessions with no principal e-mail cannot store keys
* keys fall over to local users already using an e-mail