bshaffer/oauth2-server-php — pull request #116 by trickleup (2013-05-04 05:18:57+00:00)
Title: UserCredentials - Set Token Scope to Requested

For the user credentials grant, if a user is granted for example scope1, scope2, scope3, and then requests an access token only for scope1, they receive an access token for all three scopes. This is in line with the spec, 3.3:
```
The authorization server MAY fully or partially ignore the scope
requested by the client based on the authorization server policy or
the resource owner's instructions."
```
So the change is to make it more restrictive, so that the access token only is valid for the scopes asked for (which I believe is also in line with the spec?) even though the resource owner may request access tokens that covers more scopes at another time.

My apologies if I have missed something.