changed extra data to scope and allow passing of req to createAccessToken