Refactor AccessToken to compare owners with method

Instead of using equality, use #authorizes_owner?, which puts the
comparison logic into the resource owner.