minimize oauth permission scope