Issue description

The JWT contains the scopes available for a user via the scope attribute. Scope represents the capabilities the token has such as read or delete. It would be good if we can define a required set of scopes and allow or reject the request based on the required scope.