Add methods to trade auth code and verify tokens

I used the *responses* package to mock requests, which differs of your current test suite...  I find *requests-mock* not so easy to assert on.

This piece of code was originally written for a proof-of-concept, hence fully open to suggestions/feedback/wipeout :)
> or add a new kind of exception, raised in verify_token when scope does not match

I generally favour exceptions for this kind of thing, since they make it harder to "fail open" in case of programmer error.  All else being equal, let's aim for consistency with the PyBrowserID API, e.g. https://github.com/mozilla/PyBrowserID/blob/master/browserid/verifiers/remote.py#L30