allow arrays of scopes on routes

This lets you specify an array of scopes rather than only one string scope. If you specify an array, any one of the strings in the array must be in the credentials scope.