Add oauth2 flows tests

done for AGIOS-261
@cvasilak mind to review?
can we extract the long String to a constant and use it throughout where an access token is required to be matched?