BTW http://tools.ietf.org/html/rfc6749#section-3.3 (the OAuth2 RFC) says space-separated strings.

> If attached services can define new scopes, we can't keep track of them all.

True. Although one thing to keep in mind is that there has to be *some* coordination when we add new scopes: the fxa-content-server login page needs to know how to ask the user for permission for each of them. But it'd be nice if we didn't need to spin a new fxa-oauth-server deploy for each change too.