the login client gets a new scope, oauth.approvals to manage approvals for user applications