Update client credentials grant to use request scopes if available.

I put this code in for the password case, but it can be used for the
client credentials grant as well (which had a TODO along those lines).