Handle forbidden

This is based on my other pull request #417, if it's accepted I'll rebase from master so this will turn into a single commit. 

This resolves by #243 by returning 403 Forbidden along with scope descriptions when a token has the incorrect scopes to access a resource. 
Use nested module/class definitions instead of compact style.