auth.JWT should support string scope

This is mainly a follow-up of my previous PR #209. The OAuth client now supports both string and array as input for scopes, but the JWT only supports array. This PR levels up the JWT client to support both.

Comments are welcome - thanks for merging!
(rebased on current master, as proposed in #214)