Implement expiring access tokens
Allow to pass additional responders to respond_with
Allow to specify more than one scope for an endpoint
Allow to pass extra params for tokens
Allow to pass required_params to token

required_params will be matched with actual params to check if the token
may be used for authorization. For example if { job_id: 44 } is passed
as a required param, the token will be rejected for GET /jobs/33
Fix scopes and access token specs
Return Oauth headers even if none scope was matched

If an endpoint specifies more than one scope and none of the scopes from
access token matches, return oauth headers for the first of the scopes