added failing test for deserializing OAuth scopes
patch the serializer for our silly OAuth response format