update ensurePermission to check token authorized scope