Tidy up validation of access tokens/authorization codes

/to @bajtos or @ritch 

The PR fixes issues discovered by https://github.com/strongloop/strong-gateway/issues/19.