if the client doesn't ask for any system scopes, but asks for some non-system scopes, they'll now get the defaults instead of none

addresses #498