Fix scopes to be omniauth :scope compliant, allow empty scope