return 400 when auth parameter is missed.

modified token.js to return 400 when auth parameter is missed.

reference: http://tools.ietf.org/html/rfc5849
"The server SHOULD return a 400 (Bad Request) status code when
   receiving a request with unsupported parameters, an unsupported
   signature method, missing parameters, or duplicated protocol
   parameters."