Fix validation of JwtAccessTokenConverter

Because of the order of the validation checks, before this change it
was impossible to use the JwtAccessTokenConverter purely for
RSA verification (i.e. public key only).

Also moved token store tests into subpackage to match the classes they
test.

Fixes gh-245