Stricter validation of $accessToken and $clientIdentifier.

These values are put in HTTP headers without escaping, which can cause
weird bugs.  For example, a newline will cause the stuff after the
newline to be interpreted as a new HTTP header.