More specific return values from test_credentials

Separate success from ID assertion

Allows better pattern matching:

```erlang
case mojoauth:test_credentials(...) of
  {ok,undefined} ->
    %% Correct but no ID asserted
  {ok,Id} ->
    %% Correct with asserted ID
  {expired} ->
    %% Expired
  {invalid} ->
    %% Not yet expired but otherwise invalid
end
```

@polysics ?