Expiry token

### Issue ###
During Authorization, the existing code always made a secondary call to the UserProfile endpoint, overwriting any information in the Auth0User.Profile property.

This resulted in basic token data (such as expiry date) being overwritten. This bug appears to have been introduced as a workaround to the issue that the embedded browser supports only a limited URI length, which could cause part of the return URI to be truncated during an Authorize call with a "openid profile" scope.

### Changes ###

1. Maintain the workaround for the issue of of limited URI length in embedded browser, by only ever making the Authorize call with a scope of "openid", regardless of scope specified by consumer.
2. Prevent the unnecessary secondary call to UserProfile when only "openid" scope is specified
3. If a scope of "openid profile" was specified, make the secondary call to the UserProfile endpoint, and add retrieved information to the Auth0User.Profile property