Minor tweaks in [github] auth code (#1862)

* Move / rework is-valid-token

* TokenPool: Add allValidTokenIds method

* Minor cleanup in server.js

services/github/auth/is-valid-token.js

@@ -0,0 +1,8 @@
+'use strict'
+
+// This is only used by the TokenProviders, though probably the acceptor
+// should use it too.
+
+const isValidToken = t => /^[0-9a-f]{40}$/.test(t)
+
+module.exports = isValidToken