Make client_credentials scope optional

Per spec a "sensible" default can be given in lieu of a token with an
empty scope. In this case "sensible" is all available scopes defined in
the client.