code: func HasRole(token string, scopes []string) (*models.Principal, error) {
  	claims, err := parseAndCheckToken(token)
  	if err == nil {
  		if claims.Issuer == issuerName {
  			isInScopes := false
  			claimedRoles := []string{}
  			for _, scope := range scopes {
  				for _, role := range claims.Roles {
  					if role == scope {
  						isInScopes = true
  						// we enrich the principal with all claimed roles within scope (hence: not breaking here)
  						claimedRoles = append(claimedRoles, role)
  					}
  				}
  			}
  			if isInScopes {
  				return &models.Principal{
  					Name:  claims.Id,
  					Roles: claimedRoles,
  				}, nil
  			}
  			return nil, errors.New(403, "Forbidden: insufficient privileges")
  		}
  	}
  	return nil, errors.New(401, "Unauthorized: invalid Bearer token: %v", err)
  }
docs: // HasRole tells if the Bearer token is a JWT signed by us with a claim to be
  // member of an authorization scope.
  // We verify that the claimed role is one of the passed scopes