Handle nil application scopes

- default access_grants and access_tokens scopes to empty strings
- handle nil case in scopes mixin
- handle nil application scopes in pre_authorization