Reject invalid scopes on o auth