enforce scopes, add clientdb scope