Authenticate UserInfo bearer tokens

UserInfo endpoint required Frappe login before OAuth bearer authentication ran, allowing valid tokens to bypass auth. Tokens for missing or disabled User records remained valid, violating RFC 6749.