Don't send scopes on token request

The docs at:
https://developers.google.com/accounts/docs/OAuth2InstalledApp#handlingtheresponse

don't mention that scopes should be sent for the token request. Doing so seems to work fine when only requesting a few scopes but when many scopes are being requested, a invalid_scope error is returned by the Google servers.