fixed oauth2 scope defaulting