fixed: adjust scope in authorization