include the scope string in the code response

Optional according to 
http://tools.ietf.org/html/rfc6749#section-4.2.2

This is required if the scopes requested aren't granted (such as if a client requested "a b", but our oauth provider only accepts "a"