Fixed token refresh for clientless access tokens
Added scope reduction to refresh token grant

It is now possible for clients to reduce the scopes for an access token
when refreshing it
Merge pull request #326 from ianunruh/master

Fixed token refresh for clientless access tokens