[cfid-724] Make /check_token return 400 for an invalid token.

This allows the client to distinguish between a failed client
authentication and an expired/invalid token. Perviously the endpoint
was acting as if the token was being used for authentication, when
in fact the client uses basic auth.

RemoteTokenServices now takes advantage of this and no longer
treats a 400 as an Http client error.