Add methods to trade auth code and verify tokens

I used the *responses* package to mock requests, which differs of your current test suite...  I find *requests-mock* not so easy to assert on.

This piece of code was originally written for a proof-of-concept, hence fully open to suggestions/feedback/wipeout :)
I think we should move this logic to the caller and be more defensive here.  If you're calling this function, you definitely intend to check a scope, so we should fail out if you're accidentally passing e.g. None or the empty string.