allow a client to pass scope params in the setup phase

This allows a client to use the standard omniauth builder to setup scopes, but also to pass them in using request params at runtime.