autorizeUrl() accepts an array of scopes instead of a string

The authorize endpoint in Automatic API actually accepts a space separated list of scopes (vs comma separated).
As this list contains spaces, it needs to be URI encoded, so I though it might be better to actually pass an array.