Mention editable scopes in OAuth documentation