added token refresh on 401, some more scopes