Add methods to trade auth code and verify tokens

I used the *responses* package to mock requests, which differs of your current test suite...  I find *requests-mock* not so easy to assert on.

This piece of code was originally written for a proof-of-concept, hence fully open to suggestions/feedback/wipeout :)
One thing I'd like to add, either here or in a wrapper method, is some logic to check the scopes for you.  Rather than having each relier have to know how to safely check a list of scopes, it would be nice to be able to say something like:

```
    if not verify_token(token, scope="readinglist"):
        raise HTTPUnauthorized("invalid token")
```

This could be tricky with sub-scopes (e.g. does "readinglist" scope imply "readinglist:read" scope?  does this work for all pairs "X" and "X:Y"?) but it's worth thinking about as we iterate the design of this thing.