Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Let's extract this to it's own method:
```ruby
def scopes
  scopes = server_scopes
  if application_scopes.present?
    scopes &= application_scopes
  end
  scopes
end
```