test and ensure oauth returns appropriate error code for expired tokens