The client can omit 'scope' parameter according to http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-3.3