switch order of parameters, make secReq just the scopes