How to Implement Scoped Patient Consent in a FHIR API