authorization scope is an array now

Fixes #14.