no token means no scopes