Client application should not have to specify scope

If client application does not ask for any scopes, pre-authorization should pass.