added a null check for scopes
properly issue a new 'off-band' authorization token and associate it with an application
use the new oauth token issuance service method to create a token when an authorised application registers a new user