Add section about accessing protected resources

[aaronpk]

Mainly so that we can talk about error responses for expired tokens. Referencing RFC6749 section 7.

This is particularly relevant if we are expecting more people to issue access tokens that expire along with refresh tokens. #81

[dshanske]

The response should be, if I read correctly, 'invalid_token'.