sanitize OAuth token scopes when parsing them

fixes issue #4