Update the API.md to explain how 'Confidential' Applications work

[connorshea]

For OAuth applications you can set whether an application is "Confidential", which essentially determines whether the user needs to pass an Application Secret with the request for it to authenticate. Need to explain that in the API docs.

And also maybe make it so non-confidential applications can only use the read scope.

And try to figure out if there's a way to use state. Unfortunately doorkeeper doesn't seem to support it.