strengthen assertion for unscoped tokens

previously, unscoped tokens with the following structure would have
passed testing:

    {"access": {"token": {"tenant": null}}}

... which wasn't the desired behavior.

Change-Id: I16a718a8936bb155d68510dcf9db8eb4d4223bf4
Merge "strengthen assertion for unscoped tokens"