Fix clientId regex checking
camelCase all the things + switch back to explicit save*Token signature

There was still a confusing mix of under_scored naming and camelCase
naming, I've now draw the line as follows:
 - Everything coming in from the wild, should be underscored (as
 per the spec)
 - Everything is camelCased internally

Switching to the save*Token(data, callback) was shorter, but made
variable names VERY important, this removes some of that overhead
by reintroducing the longer
save*Token(token, clientId, expires, userId, callback)
style signatures.