modified scope validator to not reply with all possible scopes for clien...

...t when an invalid scope is submitted, added unit test for DefaultScopeValidator.java

Our security team recommended this change, to minimize potential for information leakage.