Deny all scopes when no scope is passed in the request