restrict scopes to public on unsecured connections