fix minor issue with scope validation when OAuth is being used
  The condition was wrong, and if scopes were in a different order the verification would fail