rework description of access token

[dickhardt]

see 1.4

Access tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server.

• separate out what is done by AS vs RS
• add in expiry language