autorizeUrl() accepts an array of scopes instead of a string