Scopes do not verify

The OAuth flow does not currently provide any verification of scopes.

That is, if we add a new scope we need, say "teams:write", the existing authenticated calls will never implicitly reauthenticate to upgrade scopes other than when they expire.

Typically I would solve this by binding scopes to the token, and then checking if "required scopes" (or similar) match "granted scopes" on any auth call.

This somewhat overlaps with our other oauth concerns, as we need more control over the flow in general.