Fix up fxa oauth endpoints

I think this needs to go back to "scope" now