Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Let's write this as:

```ruby
if validate_client?
  application_scopes = @client.application.scopes
else
  application_scopes = ""
end
```