moved the validate params check from session setup to request token

As @dylanahsmith pointed out the latest edits of the readme and session don't describe how to use validate_params. After some discussion we decided it also makes sense to move this code from the setup method and into the request_token method. This makes sense because this method uses the 'code' from the response which they need to acquire on their own so it will be easy and make sense to pass the other params here as well for validation.

I also fixed/added tests for validating the params. PR on the gem to follow.

plz review
Also I fixed a bunch of whitespace issues so might want ?w=1
@dylanahsmith @maartenvg