Did a basic scope implementation on user token level as well

The scopes from an application can in theory change later on.
So for example an app might just be read-only now, but require
read/write later on. With the previous implementation the app
could just change to read/write and all users of the app would
have write rights as well. This is kind of wrong as the actual
user never gave the app write permissions.

Signed-off-by: Toon Schoenmakers <nighteyes1993@gmail.com>