Pass 'profile' scope in sample app and add a foreman .env.sample

The sample app now throws a 422 when a client doesn't pass a scope during authorization so this updates the sample app to pass by default a "profile" scope