use client's default scopes if not specified