Updated API for delegation token

Does not apply as `"passthrough"` is an invention of ours to use exactly the previously provided scope. Not part of the openid spec.