Add grant approval, scope.Add, ClientAuthorization update, unit tests

Should the http status be set to an error status?