added scope checking and has_scope endpoint