Added scope reduction to refresh token grant

It is now possible for clients to reduce the scopes for an access token
when refreshing it