add scopes to authorize