Bugfix: access token scopes are strings

[fixes #329]