Add a set check for scope in refresh token grant

The refresh token interace suggests that returning a scope is optional,
however the refresh token grant does not handle undefined scopes in the
getScope method correctly the same way other grants, such as the user
credentials grant does.

Modified the getScope method in RefreshToken to return null if the
storage class's getRefreshToken method does not return a scope.

Fixes #422