Include required fields on AccessToken type, always serialize Items fields

Add oauth validation and tests
Change etcd paths to match upstream
Replace nested authorizetoken with reference