Harden alternate token retrieval

[erain]

Summary:

• Keep alternate token retrieval constrained to the configured endpoint response.
• Add coverage for successful token parsing and unexpected non-successful endpoint responses.

Validation:

• go test -mod=vendor ./config
• go test -mod=vendor ./...