Requests with insufficient scope should respond 403 Forbidden

This resolves #243 by returning `403 Forbidden` along with scope descriptions when a token has the incorrect scopes to access a resource. 
`headers.merge!(@error.headers.reject { |k, v| ['Content-Type'].include? k })` can go outside of the `if`, it's exactly the same in both branches.