Add Forbidden token response

This resolves isssue #243 by returning 403 Forbidden with a description
of the missing scopes when a token has insufficient scope to request a
resource. Adds a ForbiddenTokenResponse class, and tests for the
implementation.