Test refresh token scope restrictions