Token scope permission class

Like suggested, here is a token scope permission class with tests.