Ideally this would be split into several test methods, along the lines of

test_authentication_required
test_invalid_grant_type
test_authenticate_client_id
test_invalid_refresh_token
test_invalid_scope
test_valid_token_request

but I/we could sort that out later.