Expose client authorities in /check_token

Fixed gh-274
Pass resource ids through to OAuth2Request from TokenRequest

Fixes gh-271