Check application-level scopes in client_credentials and password flow