Client application should not have to specify scope

If client application does not ask for any scopes, pre-authorization should pass.
Add better support for token reuse

Modify Doorkeeper add tests to ensure token can be reused if requsted scopoes is a subset of authorized scopes.
Merge branch 'feature/no_scope_should_be_valid' into feature/access-token-reuse