(#10): return claims within access_token response

add profile feature to signin utility

(#13): Improve introspect end-point

* return `active` field
* update networking stack
* use 401 Unauthorized for invalid client identity
* use 403 Forbidden for invalid tokens, etc

Support https

Merge pull request #6 from fogfish/http-combinator-library

Use http combinator library for oauth2 api

fix conatiner config for local deployment

fix app version