Provide consented scopes in callback

Hi!

The [Github API](https://developer.github.com/v3/oauth/#response) returns the consented scopes in a `scope` field along with the access token. It would be cool if this metadata was provided in the verification callback. This is useful in applications that deal with multiple access levels.

Start by locating the OAuth verification callback and the handling of GitHub's access-token response. Confirm how the API's `scope` field is currently received, then expose the consented scopes through the callback; done means applications can distinguish multiple access levels.

Written by the indexing model from the issue text.