Always parse the scope parameter for commas
There is no security filter for /oauth/authorize so we haven't added that filter
This filter was applied when login server was separate as it was hitting a different endpoint