Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Let's do either:
```ruby
@server, @request, @client = server, request, request.client
```
or a line for each assignment.