Check application-level scopes in client_credentials and password flow

Gonna write tests l8r
Anyway, let's better not change this snippet, if it doesn't change behavior. Hound shouldn't complain for unchanged code, and if it does I'll remove it's comments.