ensures invalid_token is returned according to http://tools.ietf.org/html/rfc6750#section-3.1