added tests for no scope case
removed controller protected in some oauth calls