Convert permission checking to use token scopes

[cqr]

Modify Policy classes to check for narrow scopes instead of (a) general membership or (b) role-level abilities. Tokens are distinct from profiles and may not include all of the permissions implied by a given role.