Fetch new token when A2 returns token_denied
Fetch new token when A2 returns token_denied

A1 distinquishes between token denied and expired, while A2 does
not. delivery-cli distinquished between the two, but that doesn't work
in A2 land. We now look for either token_expired or token_denied_by_a2
when deciding to fetch a new token.

Signed-off-by: Mark Anderson <f1b5a91d4d6ad523f2610114591c007e75d15084@chef.io>

chef/delivery-cli,chef/delivery-cli,chef/delivery-cli