Always issue an access token upon request

Returning the existing token when there was one accessible let to
issues when dealing with multiple authorization methods.

Once the resource owner authorized the app on the web, while the token
was still fresh, the r.o. would authenticate using a mobile app -
using any flow - and the previous existing token would be revoked.

This would break the web app, since the token it was being used got
revoked.

Mentioned in issue #191
Merge branch 'always-issue-token' into 1.0