Return scope in access token response

Fixes #9