Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
I believe this will read better like:
```ruby
Helpers::URIChecker.native_uri?(redirect_uri) ||
  Helpers::URIChecker.valid_for_authorization?(
    redirect_uri,
    client.redirect_uri
  )
```