oauth2server: set default scopes on personal token creation