Passing test for complete auth code token flow

Also

  - friendlier naming of middleware functions
  - client_credentials flow passes early tests (required for
    testing auth code flow)