Is there any harm in authorizing the `http` instance in the case that no scopes are required? In particular, I feel like we can simplify our lives:

    if credentials:
      if credentials.create_scoped_required():
        credentials = credentials.create_scoped()
      http = credentials.authorize(http)

Now the logic is pretty clear: if we have credentials, we're going to authorize the http instance; if we have the default credentials, we first possibly create a scoped token from those.