some basic unit tests for RequestHandler
verify that the required sub and scope fields are available from token introspection endpoint before using them
fix bug in Path with module roots, some more cleanups
add Access-Control-Expose-Headers response header