token result fixes

* getTokenReponse is now returning the format expected by http://tools.ietf.org/html/rfc6749#section-5.1
* added our app href to the JWT
* expires_in and timestamp are now second values, not millisecond
AuthRequestParser for getting data from the request

allow us to look at request body, or url params