Actually test scopes

Because of some recent changes I made to doorkeeper. tokens weren't
actually testing to see if they had required oauth scopes.

I think it's debate-able about whether these changes and tests belong in
the controller specs or in request specs