authenticate_client doesn't use the scope