ensures invalid_token is returned according to http://tools.ietf.org/html/rfc6750#section-3.1
fixes tests for e367a02d6ccb0abfd886eefffc88f98e5c8812a8