Handle forbidden

This is based on my other pull request #417, if it's accepted I'll rebase from master so this will turn into a single commit. 

This resolves by #243 by returning 403 Forbidden along with scope descriptions when a token has the incorrect scopes to access a resource. 
Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.