fixed scopes handling

the security system now refreshes scopes at login so we're (most of the
time) accurate

Ideally, it should be refreshed before any action requiring a specific
scope