Check for authorized client

These changes allow the user to specify which client the provided token must have been issued to. Tokens issued to other clients are not allowed to the endpoint. The client can be specified by IL group if desired.