extra auth scopes