Fix empty body in browserid assert

fixes #1
additional makes sure the correct json class is picked up which is an issue if there is an `Sinatra::JSON` module (`sinatra-contrib` provides that for example)

As Bonus it add a simple check on the response code and only accepts codes in the 2xx range.