Fix to scope check

Changed to scope check to containsAll to make sure authorization
contains every requested scope.