How do I authorize access to API Gateway APIs using custom scopes in Amazon Cognito?