Get assertion from correct parameter, and check type

When used for authentication, the spec states that assertions should be in a `client_assertion` param.  This patch fixes the strategy to look for the assertion in that param, and thus allows requests that contain assertions as both credentials and grants.

The patch also checks that `client_assertion_type` matches the expected value for JWTs, allowing endpoints to use both JWT and SAML assertions, if needed.

References:

http://tools.ietf.org/html/draft-ietf-oauth-assertions-12#section-4.2
http://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-06#section-2.2