Tidy up validation of access tokens/authorization codes

/to @bajtos or @ritch 

The PR fixes issues discovered by https://github.com/strongloop/strong-gateway/issues/19.
If `err === undefined && a === undefined`, this will call `done()`, effectively signalling that the operation was successful. Is that intended?

I would expect something like `if (!u) { return done(new Error('Unknown client ' + appId)); }`