whitelist scopes in the route configuration

Doing it in routes to be consistant with our other whitelist
configuration.
by default all scopes are whitelisted.
update development docs for route scope whitelist
don't set whitelist scopes to [] if nil

scopes.present? gets rid of that anyway
Merge pull request #51 from att-cloud/whitelist-scopes

Whitelist scopes in route configuration