Removed return statement as it precluded checking token expiry.
Only change scope if refresh_token grant asked for it.

Section 6 of the OAuth2 RFC says that if scope parameter is omitted it "is treated as equal to the scope originally granted by the resource owner." Previously oauth2app cleared the scope if the scope parameter was omitted.

Fixes hiidef/oauth2app#51.