Only ask for devstorage access when needed

- so on import, 2 scopes are used, and for everything else only the
genomics scope is used.
- we get around the limitations of the stored token by storing the 2
types of granted access in different places (user1 and user2 <— so
fancy i know)