Pass the default scope to storage.

The spec says:
>   If the client omits the scope parameter when requesting
>   authorization, the authorization server MUST either process the
>   request using a pre-defined default value or fail the request
>   indicating an invalid scope.

What I expected is:
- If the request didn't specify a scope, one is requested from the Scope utility class.
- If getDefaultScope() returned FALSE, validation fails. 
- If getDefaultScope() returned a scope, validation succeds.
- The default scope gets passed and set on the generated authorization code / token.

The last assumption doesn't happen. Storage doesn't get the default scope.
Since that seems illogical to me, here's a PR that attempts to fix that.

In GrantController it might make more sense to take the default from the authorization code instead of taking it from the Scope utility class, that's your call.