Fix flaky test depending on internal order.

Python 3 is not consistent in internal order
when using sets, dicts etc and test should
not depend on that being the case.
Return OAuth2Tokens instead of dicts in endpoints.

These behave exactly the same as previous dicts but
have convenience methods such as ``token.scopes``.