keep CRUD methods public

Signed-off-by: Tomas Neme <lacrymology@gmail.com>
add a Token.save method just to be coherent with the Client API

though I don't think it's going to be used

Signed-off-by: Tomas Neme <lacrymology@gmail.com>
convert Token.accessTokenExpiresAt to datetime object

Signed-off-by: Tomas Neme <lacrymology@gmail.com>