Implement scopes

OAuth 2 has "scopes", which allow apps to limit their access to user data. Scopes are required per the spec, so we need to decide what we're going to do with them. (The scope parameter is a space-delimited list.)

There's a few options for what we could do here:

• Ignore the scope parameter, and have a dummy value for clients which need one (e.g. *)
• Allow clients to specify roles they're requesting: scope=subscriber could be used if the app only needs user-level data, e.g.
  • We could also allow clients to specify exact caps that they want as well, e.g. scope=subscriber edit_posts
• Use handcrafted scopes: scope=user.read. I have an existing design for this from the OAuth 1 days.

These each have benefits and drawbacks, so we need to decide what we want to do.

Start with docs/spec.md's authorization-scope section and compare it with the three alternatives listed in the issue. The work is not ready for implementation until one scope model is chosen; done means the selected behavior is specified and implemented consistently with the OAuth 2 scope parameter.