Bugfix for handling non-standard comma-separated scopes

The check is supposed to look for spaces or commas within the value of a singleton set, but the code currently performs the contains check for "," on the initial set of scopes (which kind of misses its target).

The two test methods show that setting a single value scope directly on the `AuthorizationRequest` class (not via the parameters) will result in exploding the value if it contains spaces or commas.
Running the same test on the original code would only pass one of the two tests, as the `,` character is not looked for in the right place.