make sure that client presenting refresh token is the same client the refresh token was issued to

closes #735
fixed checking of refresh token permissions in client service, clients can now request either refresh_token grant type or offline_access scope and it will work. added checkbox to dynreg page for ease-of-use

closes #734
made offline access non-default
removed unused variable in dynreg page
relaxed scope constraints on protected resources registered through self-service page
fixed unit tests