protect the /approvals endpoint from client access unless the oauth.approvals scope has been set.