fix token exchange

token exchange is broken on golang:master since 97a89b3be5a

at some point in the last few months i signed the google cla already. with tests cause tests should have caught this imo
Could we test it against `application/x-www-form-urlencoded`? We should never support form decoding if response type is text/plain, but rules have been relaxed to support bad server side implementations. Maybe we should remove `text/plain` from oauth2.go:217.