uaa.user also has to be a default scope for the login client