fixes #60 - allows scope to be passed in either request or query