Client application should not have to specify scope

If client application does not ask for any scopes, pre-authorization should pass.

this is for https://github.com/18F/myusa/issues/221