Validate scopes when performing a token refresh

Without the code added on line 104 of `refresh_token.py`, the scopes given in the HTTP request body are not incorporated into the `request` object, and as a result, a new access token is granted with no scope.

I also removed a duplicate definition of the `RefreshTokenGrant` class that was floating around in the `client_credentials.py` file which was pretty confusing ;)