saving scopes set during client app auth