* Invalid token returns 401 Unauthorized, instead of 403 Forbidden, as defined in section 3.1 Error Codes of https://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-23