verifyToken should return 401 invalid_token instead of a 400 invalid_grant