thephpleague/oauth2-server — pull request #186 by shadowhand (2014-07-11 17:02:01+00:00)
Title: Send HTTP 401 for invalid_token, rather than insufficient_scope

Incorrectly read [the spec](http://tools.ietf.org/html/rfc6750#section-3.1) or possibly copy/paste fail, but the new resource server error handling should be using 403 for scope and 401 for token.