Follow scope settings strictly

It would be good if the authenticator followed scope setting more strictly since the token could contain extra claims that we don't want. Scope settings in xwiki gives better control.