Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Useless assignment to variable - `server_scopes`.