he use case of user-facing third-party
app authorization, we recommend the OAuth-based SMART protocol 
see <a href="security.html#authentication">Security: Authentication</a> as an
externally-reviewed authorization mechanism with a real-world deployment base -
but we note that community efforts are underway to explore a variety of
approaches to authorization. 
</p><p>
Resource Servers MUST enforce the authorization associated with the access token. This enforcement includes verification of the token, verifi