resources != token endpoint

Issue #339 resolved
Brian Campbell created an issue

A7 & A8 in the attacker model read like they are grouped in with "Attackers at the Token Endpoint". Maybe a new heading for 'attackers at resources' or something would organize them better?