Errors are now returned from grant handlers instead of immediately logged.
Basic token validation functionality (no scope chekcing).