Tidy up validation of access tokens/authorization codes

/to @bajtos or @ritch 

The PR fixes issues discovered by https://github.com/strongloop/strong-gateway/issues/19.
What's the point of keeping the code commented out? Either use `describe.skip` or remove the code altogether.