Token creation view redirects to callback

It passes the token appended to the callback url
Auth and token views validate request if scopes are valid.
Valid scopes are listed in external config.
When asking for a new token it checks if any
access to any newscopes approved, if so then update
the scope list in the token record.