authorization_class.create takes scopes argument