services/oauth2/access_token_validation_service#sufficent_scope?, scopes array should be string.