Fix demo bug where unverified scope access token was displayed.
Fix bug in GoogleTokenVerifier causing it never to work.

Apparently, I was horribly misusing constants.  Comprehensive tests would have uncovered this.  I'm not convinced that I'm doing the right thing by injecting services inside the verification function, and this particular section (the verification function and how best to make that customizable) could really use a second pair of eyes.

It would help to know a pattern for configuring functions that use services inside providers.
Merge remote-tracking branch 'origin/master'