anchor.diff:          + data (Plugin_Proxy)
             + name: proxy (string)
   
  -## oAuth Auntenficiation [/apis/{api_id}/plugins/oauth]
  -
  -This plugin sends request to an oAuth server that should return scopes that is valid for consumer.
  -
  -This plugin **DOES NOT** authorize API resources, for this purposes use [ACL](#reference/plugins/acl/get-all-requests) plugin.
  -
  -But if token is invalid, appropriate error response will be send back to api consumer.
   
   ## JWT Authrozation [/apis/{api_id}/plugins/jwt]
   
   ### General Information
  -JWT is a authroization plugin that decodes JWT tokens received from api consumer (with a `signature` field that is set in settings) and extacts `scopes` field from it.
  -
  -This plugin **DOES NOT** authorize API resources, for this purposes use [ACL](#reference/plugins/acl/get-all-requests) plugin.
  -
  -But if token is invalid, appropriate error response will be send back to api consumer.
  +JWT is a authroization plugin that decodes JWT tokens received from api consumer (with a `signature` field that is set in settings).
  +
  +This plugin **NEITHER** authorize API resources, **NOR** apply consumer scopes to request. For this purposes use [Scopes Resolver](#reference/plugins/scopes-resolver) and [ACL](#reference/plugins/acl/get-all-requests) plugins.
  +
  +If token is invalid, appropriate error response will be send back to api consumer.
   
   **Warning!** JWT signature should be Base64 encoded. Some providers (for example, Auth0) already encode it for you.
   
  
positive.code:     + GET
      + DELETE
  + path: ^my_resource/ (string, required) - Regular expression on path. **Warning!** It's relative to API path.
  + scopes (array[string], required)
      + request_api
      + read_profile
  
  ## Validator Plugin
  ### `Plugin_Validator`
  
negative.code:         + data (Plugin_JWT)
            + name: jwt (string)
  
  ## Scopes Resolver [/apis/{api_id}/plugins/scopes]
  
  This plugin resolves scopes based on JWT token contents or by sending upstream request to authorization service.
  
  Right now it supports two strategies:
  
  - `jwt`
  - `pcm`
  
  #### JWT Strategy
  
  Scopes should be part of `app_metadata` in a JWT token. See [JWT Authorization](#reference/plugins/jwt-authrozation) plugin description.
  
  #### PCM Strategy
  
  Resolves token by sending request to authorization service. `url_template` setting is required. 
  
  Remote API service should return HTTP 200 status code and following json structure:
  
  ```
  {
    "meta": {
      "code": 200
    },
    "data": {
      "scopes": [
        "originator_loans:upload", ...
      ]
    }
  }
  ```
  
  Inside `url_template` you can use `{party_id}` to substitle consumer ID in a request path, ie.: `http://ec2-52-58-60-8.eu-central-1.compute.amazonaws.com:8081/0/api.svc/party/{party_id}/scopes`.
  
  ### Bind Scopes Plugin [POST /apis/{api_id}/plugins]
  
  + Parameters
      + api_id: 1 (string) - API ID.
  
  + Request (application/json)
      + Attributes (Plugin_Scopes)
        + name: scopes (string, required)
  
  + Response 201 (application/json)
      + Attributes (Response_OK)
          + meta (Response__Meta)
              + code: 201 (number)
          + data (Plugin_Scopes)
            + name: scopes (string)
  
  ### Change Scopes Config [PUT]
  
  + Parameters
      + api_id: 1 (string) - API ID.
  
  + Request (application/json)
      + Attributes (Plugin_Scopes)
  
  + Response 200 (application/json)
      + Attributes (Response_OK)
          + data (Plugin_Scopes)
            + name: scopes (string)
  
  
  ## ACL [/apis/{api_id}/plugins/acl]
  
  ACL allows to protect your API's (or proxy `upstreams`) by a scope-based authorization.
  
  Once enabled it will read `scopes` that is exposed by Scopes Resolver plugin. If there are no scopes, it will send responses with `unathorized` status.
  
  If path is not defined (gateway can not extract list of scopes needed for path), unathorized response is sent.
  
  