Update permissions to use scope strings

Update permissions to use scopes as described by #36 

Still need to determine how to represent long-lived revocations which do not overwrite an existing permissions but limit a wider permission.