Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Yes, that's what I meant. Extract to the same class. If you don't think it's clearer that's fine. I'd still avoid the `if` at the end of the line.