Respect UAA scopes during access control