Add grant approval, scope.Add, ClientAuthorization update, unit tests

use `len(then) == 0` just to be consistent with other code we have in other places