Add oauth2 flows tests

done for AGIOS-261
@cvasilak mind to review?
s/revoke token reset session/access token