Check for X-OAuth-Scopes instead of matching tokens

This is a more robust way to determine whether the request was made
with a PAT.