FIX: Profile API does not return error if user does not have profile scope authorized

If no profile scopes are authorized, the app will still allow a caller to get access to the profile.  Instead, it should respond with an error and 403 status.