I just tried:

1. access_token=:valid&client_id=:valid
2. access_token=:invalid&client_id=:valid
3. access_token=:valid&client_id=:invalid
4. access_token=:invalid&client_id=:invalid

4 fails, but others passes. Not sure how API limit applies to 1 (app or user quota). I could flood Instagram to find out :)