backpackConnect.authorize() middleware now also sets request.user.
Added an optional 'permission' arg to backpackConnect.authorize() middleware.

This makes the authorize middleware check to ensure that the given
permission exists on the passed-in access token before allowing the
request to proceed further.
The /api/issue endpoint now works.

This commit reveals inconsistencies in the way errors are reported to
backpack connect clients, though: a lot of my code just returns a
text body containing a description of the error, while other errors
are reported solely through the WWW-Authenticate header as per rfc6750,
while the errors returned by the issue endpoint are JSON blobs.

We should probably update the backpack connect draft spec to explicitly
specify what needs to be returned when error conditions occur.