introduce OAuth2Scope to all api methods. This lets you use different accesstoken when validating for documents with different authentication levels