Add testcase to prove that XSS can break the access token validation.
Quote the access token so it can't break the validation.
Merge pull request #157 from androa/issue-156

Quote access token before validation