Decoupled access token handling

This continues #95 but will be improved with #36 and #103.

Access tokens have been decoupled from `FacebookSession`! Yay. Now we can handle access tokens directly.

```php
use Facebook\Entities\AccessToken;

$accessToken = new AccessToken('my_short_lived_token');

// AccessToken object can be echo'ed as a string
echo $accessToken; // my_short_lived_token

// And exchanged for a long lived token
$longLivedToken = $accessToken->extend();

// . . .

// Obtain a code for this long lived token
$code = AccessToken::getCodeFromAccessToken($longLivedToken);
// Obtain a short-lived token for use on clients
$shortLivedAccessTokenForClients = AccessToken::getAccessTokenFromCode($code);
```

And you can grab it from `FacebookSession` and play with it.

```php
use Facebook\FacebookRedirectLoginHelper;

$helper = new FacebookRedirectLoginHelper($redirect_url);
$session = $helper->getSessionFromRedirect();

$accessToken = $session->getAccessToken();

if ($accessToken->isLongLived()) {
  // This is a long lived access token.
  // That means you can get a code with it.
  // Or store it in the database and use later.
}

if ($accessToken->expiresAt()) {
  echo 'Your token expires at ' . $accessToken->expiresAt()->format('Y-m-d H:i:s');
} else {
  echo 'Your token never expires!';
}
```

`FacebookSession::getToken()` works the same as it always has (returns a string of the access token).

Now, there is still a lot of work to do on this. There are still some pretty deep method calling as well a too much direct access to Graph in the tests, but it's def a good step in the right direction! :)
... because here you assume it's an object.