OAuth 2.0 grants should be a list