Deduplicate code in grantToken.js's.
Fix ROPC to give invalid_grant error for bad username/password.

Per http://tools.ietf.org/html/rfc6749#section-5.2, that is the correct error type for bad resource owner credentials; invalid_client, used previously, should only be used for bad client credentials.
res.sendUnauthorized() → res.sendUnauthenticated()

The work in #15 to introduce scopes makes it clear that we need to be more careful differentiating between authorization and authentication. The method previously-known-as "sendUnauthorized" was really meant to be used in situations where there was no *authentication*, so it needs to be renamed.

This is a breaking change.