refactor listAccessTokens to reduce promises

The documentation for when.js suggests that "when.defer()" is
discouraged and we should use when.{promise, lift, try} instead in most
cases.

I also realized that *most* of places that return promises are
unnecessary, since the things they're returning are *already* promises
up the chain, so I reduced the noise there.
tokens: make token list output nicer

Make the following changes to the token list command:
 * sort tokens by expiration date, newest first
 * First line is the client name, not the token
 * put an asterisk (*) after the client name for the token this cli is using