Check for namespace in verifyscope, which is called when a client tries to login. Trusted client resources is not required. Removed it.
Check for namespace in token/verify API call.