Update appengine-web.xml

Fixed the SSO scopes for both sandbox and prod.