Fix OAuth token endpoints

The token endpoint response is now correctly documented as application/json. Optional fields code, refresh_token, and redirect_uri no longer accept null — omit them when not applicable.