correct endpoint for extending short-lived access tokens + unit test

See #127.  Without a user access token in the test environment it is difficult to write a proper unit test.  This test only checks whether the endpoint returns the expected error message.