Fix use of pre-approved scope

Resulting scope should be the intersection of previously approved with
currently requested scope, not the difference between them.

This will change in future anyway with support for approving additional
scope.