ensure client access tokens have "client" scope by default; tests for ClientToken