refactor route authorization middleware to more clearly support role, group, and scope
fix the way oauth2 scope is passed through to token