Make scope_matches() guard against accidentally-empty list of scopes.
Make client id and secret be properties of the oauth.Client object