Make tests run on node v0.10
Ensure bodyParser() is used before token middleware
Require a client when exchanging an authorization code

If you use public clients, consider using timshadel/passport-oauth2-public-client
as your authentication strategy to ensure that you have a client object
prior to the exchange taking place.