Client application should not have to specify scope

If client application does not ask for any scopes, pre-authorization should pass.
Merge pull request #223 from 18F/feature/no_scope_should_be_valid

Client application should not have to specify scope