Fix up fxa oauth endpoints

yes, "scope"