Use HTTP Basic auth method for token request; verify access token signature