made /token endpoint world-accessible, fixed storage of "granted" field in AuthorizationCodeResponse and added dummy redirect_uri to fool oltu's oauth request validation for the /token endpoint