make Authz.ScopesMap() return a Scopes object instead of a raw map