Add deeper unit tests to authentication path. Use a primary read if the initial token lookup fails. Implement an admin authorization script, index by user_id, and denormalize expires_in.  The read scope should reject access to the authorizations controller.