Use return value from TokenEnhancer.enhance

The enhancer is supposed to return a new token -- but `DefaultOAuth2ProviderTokenService` was expecting (relying on) mutations instead. Ditto for the tests. Which made it hard for me to extend these classes for my own purposes.

This PR is just a one-line fix + test updates.