Alternative access token locations

There was a typo which would prevent both "request body" and "URI params" access token methods of token verification to fail. Fix added with tests.