api: Use the string versions of the client secret

This is ugly, but because Consumer#secret is a UUID, we should be using
the Consumer#client_secret property here which is a string (unicode)
representation of the secret.

The prior state causes 500s on the token endpoint on a fresh checkout.

This commit also adds a test suite for h.api.Token