Authorize token for resource access

Verify a token header and validate it against a requested access scope.