test validation of token params; require refresh token for refresh_token grant; 400 error headers