Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Another option:
```ruby
def scopes
  if application_scopes.present?
    server_scopes & application_scopes
  else
    server_scopes
  end
  scopes
end
```