Check application-level scopes in client_credentials and password flow
Merge pull request #538 from creasty/fix_app_scope_validation

Check application-level scopes in client_credentials and password flow