Ensure v2 tokens are correctly invalidated when using BelongsTo

Due to the optional paramater of the tenant on several v2 token
validation methods, we need to ensure that calling token validation
with different permutations of parameters does not lead to an incorrect
cache value being returned.  This is done by lifting the 'BelongsTo'
checks out of the token backend and into the Manager, in a layer above
where the token caching takes place.

Fixes bug 1226225

Change-Id: Ifa3162923ad41aac6a9e5d5b4996bc43dc9b11fb
Merge "Ensure v2 tokens are correctly invalidated when using BelongsTo"