addedd default client scopes, per-token scopes which must be of the client's scopes