Scopes should be based on /auth/, no /auth/userinfo.

According to https://developers.google.com/+/api/oauth#scopes, valid
scopes are:
- https://www.googleapis.com/auth/plus.login
- https://www.googleapis.com/auth/plus.me
- https://www.googleapis.com/auth/userinfo.email

So you should not scopes start with userinfo. ...