Send x-oauth-scopes header as well as other x- headers

Sometimes you need to know the token's scope (eg, if you have an app that has multiple levels of github integration: public and private). The other x-headers are already being passed back; this just adds x-oauth-scopes into the mix.

cheers,
H