Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
@tute well, how about like this?

```ruby
application_scopes = if @client.present?
                        @client.application.scopes
                      else
                        ''
```