fixed scope format in authorization request