pass scopes to checkToken()