Explain how to send granted tokens. Closes #4.
Follow specced error response semantics better.

Perusing http://tools.ietf.org/html/rfc6750#section-3.1 leads to the following realizations in how Restify–OAuth2 could better serve errors made against authenticated resources:

- Invalid requests should be 400 errors, not 401.
- When sending a `WWW-Authenticate` header in response to invalid requests or invalid tokens, the appropriate error code and description can be included in that header.
- However, when the server triggers `res.sendUnauthorized()`, that represents a situation where the client did not send any authorization at all, and so per the spec no error code or description should be included.
Upgrade dev dependencies.
Add Node.js 0.10 to Travis.
Version 2.1.0