the uaa.user scope is no longer needed, the scope for /approvals is oauth.approvals. the login client is not using the uaa scope anywhere else.