Change "invalid_grant" to "invalid_token" when authorising a req (#5)

Previously the "error" param would be "invalid_grant" for a missing
or expired token. This wasn't a good descriptor as no granting was
been done, "invalid_token" is a more accurate description.
Switch all save* functions to (data, callback) signature + normalise to "_"'s

Rather than passing a load of parameters to the model save* functions,
now they are passed two parameters "data" and the callback.
To aid with this (and for other sanity reasons) all interfaces with the
model now use underscored variables (e.g. req.oauth.grantType -> grant_type)
Also included are a few fixes in tests etc.
Switch from tabs to double spaces
Complete postgres example
Detect 'invalid_token' as 400

'invalid_token' was added in 07db945 however it was missed from
here and so the code was being set as 500
Inital refactor of grant code
Styling fixes
Abstract runner

The runner just a simple version of async.series with explict context
binding
As async library is no longer needed it's also been removed from package.json
Change runner to call next when finished
Minor style fixes
Refactor Authorise

Now similar to new Grant style
Swap _this for self
Rename tests to better fit new class names
Don't call done() in final function
Refactor usage pattern

Module provides three middleware, one for granting, one for auth
and one for handling subsequent OAuth errors
Docs
Remove superflous assert module
Tidy up top level test names
Fix order of statuscodes in expects
Add lockdown pattern