add scope to auth url