The OAuth2 adapter conforms to the implicit spec http://tools.ietf.org/html/rfc6749#section-1.3.2

However, there are some providers, like google, who add another to validate the token.

Also there are some providers who separate the "scopes" with comma's instead of a space

it would be nice to have options for the devs