Following PR feedback, document the return type of `_getAccessToken`
explicitly and make the error thrown in the event of a non-2xx response
more informative.