Validate client details in DefaultTokenServices.loadAuthentication(token)

If the ClientDetailsService is not-null it is used to validate the client
still exists and still has access to the scopes in the token. This commit
only addresses the existence of the client. Scope checking is something
that ought to be ain a strategy and we don't have an appropriate one
right now so more thinking required.

See gh-185