Whitelist scopes in route configuration

Doing it in routes to be consistant with our other whitelist
configuration.
by default all scopes are whitelisted.

Closes #6