APIToken now allows multiple scopes