Should we add support for the scope param to 1.0.beta4? It can be done as part of the
access code work.
To make it OAuth2 friendly I propose we use the following format:
?scope=realm-role1 realm-role2 app/app-role1 app2/app-role2
Basically a "list of space-delimited, case-sensitive strings" as specified in
the spec, where each string is either "<realm role name>" or "<app
name>/<app role name>"