Only call AuthorizationAdapter#scope_collection for collection.

This commit ensures that #scope_collection is only used to retrieve the
collection, not when finding a single resource. The issue was that
resources may be scoped out which result in an
ActiveRecord::RecordNotFound when it should result in a authorization
exception.